Extracted

• • Target

    file.exe

  • Size

    526KB

  • MD5

    8e5250757680a898ec1326e7687fc3d2

  • SHA1

    547216b00a3428d47aa1571f1b00a0d6a8b08963

  • SHA256

    9e2c04b75b426f01df926763c5ece69da2dff34a12262fd579b6af60c1c0e404

  • SHA512

    3202ab57f90df5a63b9f9a9468632f1b5e211f9a877d4ca452e8b4a0abf2fe8da12815a97c4ebdf48012829bf94a056c4fdef8daa5381c52e57659554ac1952d

  • SSDEEP

    6144:K2y+bnr+jp0yN90QELGVpS6LV8fIeWVrodhYcKgFBpn5EcduDB/82Y+q7CCrZA8/:yMrLy90tGC6LDew0HrxaIPCe4e7ZgS

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2