Extracted

• • Target

    b6b5c554fc3d560ff33019c81c92d49c7c1acacd57276f3a1ba133fe97e6f6f0

  • Size

    526KB

  • MD5

    9ff9e445a7540232f017b508795b1291

  • SHA1

    070888336befb7d39c96ac60906047491a53e576

  • SHA256

    b6b5c554fc3d560ff33019c81c92d49c7c1acacd57276f3a1ba133fe97e6f6f0

  • SHA512

    7db7714b2762342ab534c60c79c12edc370f9ed3949f1243bf0bbd7d2b1e802a233cd692f813ee288cbe20548458790ad61c82e8ea48dda781ce0bd9780c5b2c

  • SSDEEP

    12288:tMr4y90QYWRczui3vtD6pgH7jAQqj7YLhcGua2vcnfcaaH:RyVn/i3lD6pCvAQGYoabnzG

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1