Extracted

• • Target

    file.exe

  • Size

    566KB

  • MD5

    f52a0bd187425ea34e0e57c3f989674d

  • SHA1

    6d21e538eaafbe33d2d5ed1eaa603988edf37744

  • SHA256

    728680d2b009f96df9c5cc0d867531f437a54352e0e66d67fe2269d0df793cb5

  • SHA512

    55b088cfd8973d83a433e0e9e44ee535bc71e1f5d3f25854850ed54b6ba720c85402c2b62c64bca83fe62dcdf5db0ce48e587cffc7a3ef36a5ef8d11a1604a8d

  • SSDEEP

    12288:0MrAy90pSjNt5CpUDJUrdAJBvQLMy4xVAggiXXL6dvpK:kyfjNKUCrdQ5QLt4wCr6dBK

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2