Extracted

• • Target

    24278cae85c470b4132cf8c51df8542738feeb544e9732dcbf60bdbfea37fbe4

  • Size

    566KB

  • MD5

    b08475723ee9b28711bdd987bd217cee

  • SHA1

    7bd21cb2e4de5db56b648567b640a05b368f57c0

  • SHA256

    24278cae85c470b4132cf8c51df8542738feeb544e9732dcbf60bdbfea37fbe4

  • SHA512

    ead72489456e4941d434a51d41eb5113c67220070b9c20e9e03d1f55a63b302a6710deb54d84b981eebb006b5fd882dd756f0a4f2b9ec95c402df04a4a41f18b

  • SSDEEP

    12288:BMrAy90qK7g63nCqQ1rAJBvgLMy1xHmJqrecwo86SA:1yfIZ3CquQJgLt1Nmqe7y

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1