Extracted

• • Target

    fed9d021939197bacefe389c723089cecf91a210461a10df5d35d63cd5760119

  • Size

    566KB

  • MD5

    3afc44335a5279397389069c8dd44276

  • SHA1

    63c4d7aec1b35b7cac83b52d696efafa1dbca238

  • SHA256

    fed9d021939197bacefe389c723089cecf91a210461a10df5d35d63cd5760119

  • SHA512

    8dcc443c88d8306f134779e58d20c79e6e227806554bfd5d2e5a4cd4ceb14733877cc69b1d87b3bc58e585c457b0a23cc02b74d59b5e204ccad62e3949f41b58

  • SSDEEP

    12288:pMrdy90TAq0nJbipCG0tLQ6iIcGCRDuiR01yAM:4yhq0nJupGQ6pSgYj

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1