Extracted

• • Target

    8f0e032208e8d833fcecfa62b361a8b72362c48521fd1194927215af69c277f3

  • Size

    566KB

  • MD5

    b70cfc1e177f77fa65c19c85d6a7747b

  • SHA1

    3af4451c1161eea4dd57c40b93d7e58e9524b821

  • SHA256

    8f0e032208e8d833fcecfa62b361a8b72362c48521fd1194927215af69c277f3

  • SHA512

    cdb10e22bd0205a741399de833b9bd3bde4b081a4e28098734ba52d0e581d313c96bf9f1c3ea31060252ebb7246b8ed88dc54a21662e494c79e162ee8240c626

  • SSDEEP

    12288:NMrUy90AkxrVoHfANdjoR4Hu36Jvopkunz25jUhSfE:9yEJVw/G661A25jUh8E

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1