Extracted

• • Target

    a2b71a8e613330c14dc9bc76ea604cf8c6df7cc2f1f4cd96ba67d1aebf84c272

  • Size

    565KB

  • MD5

    4b6ee2699599cd877216eba17219aaf6

  • SHA1

    575ccddc38db3e68527cf74d29e2ff0042e8603a

  • SHA256

    a2b71a8e613330c14dc9bc76ea604cf8c6df7cc2f1f4cd96ba67d1aebf84c272

  • SHA512

    1855ca6827b3b9f3b4ec3ac5e8f0f405f3630d430362635ceee55b9ee8b4dca53822ae46b0989a6e26bbdec82277bd868f0333498a5cdac3817ed2a1d3fbd1e6

  • SSDEEP

    12288:XMrIy90fxyv9GZPolAO9uDSu9jx2FeJN7szU7pikRcMR:3yT4lolAsuNjMeN5bl

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1