Extracted

• • Target

    file.exe

  • Size

    565KB

  • MD5

    3ba33e2ee71b972e3119c8c934e9be0d

  • SHA1

    7e6abf10f896537d80b43d5d9eb82aa5ab524414

  • SHA256

    57d0462b137a626ecc0d04400baa6cfdd9f8f7398affe4db80f8b88454d2a8ca

  • SHA512

    e3057aaec6bd1adb0315b4fd562241ddec773813128ef4a7e58f6f0fc1e68eedd6d2bb1241fa712db168dd8039d9c707fed5cf1f8d213b330a2e7ea68ca4ba04

  • SSDEEP

    12288:iMrdy90eX0kcnjVDr6qNYQdEleck9eqQAcKe/Xs8TEpX:vy9XLcsqNYS539JjePA9

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2