Extracted

• • Target

    file.exe

  • Size

    570KB

  • MD5

    8e9edf397bdf50df853f59e0cd3f7408

  • SHA1

    a9313595c86d094eb5e3efd7a0489158ff3c0e2d

  • SHA256

    8a3853b21d693c69be0e1b819e79c110d1277b362d2b0b7622e5244cb5664092

  • SHA512

    73d53453c71a2ba40021b516f67afe0b78296f71340602ebbc56487b35c08ec2c6fc56e857ad2fd448c852d86cffe49509476dc423dda68639e60f93097145d5

  • SSDEEP

    12288:AMrNy90HaMFVjS+vksrM/AD4827M6kWOMr/+rHo4WFsx8:dyyVm+ssrQAc82DLlr/ahYsx8

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2