Extracted

• • Target

    file.exe

  • Size

    526KB

  • MD5

    6528141a9c028fa97368167e8672a82f

  • SHA1

    01c1ba224fb711aa0fcc3432c2d4880d3161ef8f

  • SHA256

    a58bb55b53a1e193766729cac39c34d00a55d131a7f9f069fbfa6319a92e3778

  • SHA512

    79de883ed028a7b9dd1f18ff7c247719648733107c18410d259516858ea9a50c4962997091d68e49c97d9a7fd0d892d309623b11e6b93b1a47b4a98010737d9c

  • SSDEEP

    12288:3Mrvy90SHFcAc4nMVwyV0XXzmXlAJHPNfWS8Btflizd3:EyGQMVVV0XXiX+VfJ8Bttg3

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2