Extracted

• • Target

    file.exe

  • Size

    566KB

  • MD5

    a3c06eb5ecb4ead73e61c1ede40904e6

  • SHA1

    96c4c7f16957d2434ab0e6db1401ed3044e66a1c

  • SHA256

    0009a3ca74a8aecddfd34261d7e14b076347e85edf2a0a6e5d9cd760d5eedbea

  • SHA512

    ce152282bae5423bd07798065088dd103a93f016005c52eb92f5e65c183c6828cd98d3dea64088c58f9c30d16b71a81522ac7a4b3e00dae1c57b6a402cadb389

  • SSDEEP

    12288:eMrdy90+iTP73fuQk/MrDptLH6iIDGCRDuMR015dyQpEeE:DyfmP73fkMrDXH6eS41uQS

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2