Extracted

• • Target

    45367ea5407de2b6c3ad4b1f2eeb252c9cd28f752da5f4f36455720d4d2f787d

  • Size

    525KB

  • MD5

    d8aa24ee18f9fc10e27470a736555e42

  • SHA1

    de472fd7abdd516c3d9fc66cb2d148384609abb3

  • SHA256

    45367ea5407de2b6c3ad4b1f2eeb252c9cd28f752da5f4f36455720d4d2f787d

  • SHA512

    27c004509ffcade2180e733772b8c911ab6dd634b1b510c3e47bd4fab5f4df46519c87ca074b8b6dcacbf4f273c57d27d88d3bcc9c66003df9cfa2f44b794df6

  • SSDEEP

    12288:fMrgy901GXiqAVRHaPCSSic8AqLB0jQ4:LyoYiqAVkxN6jl

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1