Extracted

• • Target

    219b36462b307cd472f899a0f2ac80e49e42edc86f3bb5e9dcccebc131f970c6

  • Size

    567KB

  • MD5

    884034c68055598cc7eca7b192677585

  • SHA1

    a909ecbe1c3c710708811ecaae52c089e040a856

  • SHA256

    219b36462b307cd472f899a0f2ac80e49e42edc86f3bb5e9dcccebc131f970c6

  • SHA512

    06731452b58680cd17f32bb69adfca10fc7543f653a1e4be0d7a7928d980e7d84415126a1c2c33a0a02744fce894d720b255a1ac6c7a1fef644e1109b87e2dd2

  • SSDEEP

    12288:cMrUy90Qyd7xvIUrgMQSuU0BKukhPUmYW+gEFO5nJUX:Ay2gDMQSJ0BVkVYq7UX

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1