Extracted

• • Target

    file.exe

  • Size

    566KB

  • MD5

    84047de7d483d2468a6072811966b680

  • SHA1

    c154465416713ab126cf33448a184415eca89d08

  • SHA256

    6b177ebca9bfa8902b2fd7b46c67f93360b9412d003c200b8be66d27f7a6e9ec

  • SHA512

    a7bcb2b7c9f91c941ec849a895d2270974d5150f436959df84862939fc1f9fc309ee7ce4ea0bd0e92baf0d3cb87f9114bf61511d00b18dd4e84948b30b8f87f3

  • SSDEEP

    12288:+MrSy90WDAfTIk96AYsmnKf2Lt8zQ8jVdMJcNTar2XEv2sv:EyRDAfTG+4tEndMJcNTaaM1

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2