Extracted

• • Target

    eb4970bc9436122cc370d34b91c8376a82f0bd48d82347856b1304b7ae456fdc

  • Size

    570KB

  • MD5

    c04f22efcd78c1a623ceb6062dcee6d6

  • SHA1

    35ea284c4ddb55801b7c83d6eaa5cdf022bd65e5

  • SHA256

    eb4970bc9436122cc370d34b91c8376a82f0bd48d82347856b1304b7ae456fdc

  • SHA512

    c9a5d6bc646423330f8efa472bc84ec9849a63f4e5d3bec79844cc95d4e23d418344c775a18b7dbca63254cc6e1c83d1ad1560303590ee5375268b4ab64a40d5

  • SSDEEP

    12288:xMrty90Qhf8SH11akE3XwbM+kWOir/+ZdN4Ro24rVQ:Qyz18y1ITXwbLxr/E8ReC

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1