Extracted

• • Target

    3d23094edebd245cd59f30a1e54865e3862cd27a50dcf2c9404b1365fa7bf052

  • Size

    568KB

  • MD5

    2c5c7bdaee933098ea04a2968151599f

  • SHA1

    68153d3d79a0bb3dd602384c508947d59c9470a1

  • SHA256

    3d23094edebd245cd59f30a1e54865e3862cd27a50dcf2c9404b1365fa7bf052

  • SHA512

    089bb70b893a0b81ea1f01487d0d8d75fcc8adc6470ae88e5cae97244b742bd0a0429a7e27e5f280cc948fb52172773c7541eaf6f44cd1cc08ecf3d38e003055

  • SSDEEP

    12288:NMr+y90MXI/4q40M7GDYuBNLTe7DwdYgj/Xoq1bs+isd9Rgt:HyFi4q40M7GDYuTLT6tGoqBszsfO

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1