Extracted

• • Target

    570c0b1e521112bff1297dc4496422604ae2c67c222e6df17736953a16576b25

  • Size

    558KB

  • MD5

    50784cdd6cf16dc1ac3fd3e7a98cf334

  • SHA1

    aa029acf8ebdd11f7ebdf6a5f14ffd2a1833c4ef

  • SHA256

    570c0b1e521112bff1297dc4496422604ae2c67c222e6df17736953a16576b25

  • SHA512

    deceb015a23a065f3226a041b64c7a96ad2f8f961502d6a2135c02b58a8245c03bd83193d4fcb1ac34c8ea4c0314a7d098159825303a723bef09c8e3ab98bf3c

  • SSDEEP

    12288:/Mrzy90rPrZkUgqaxDCNyb4xjDbor22p/lMSzDzfx:QyOP1k2QCNyMxjD0DppzPx

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1