Extracted

• • Target

    afa34b3368467d6ef49c6b67fa3373db151ad1b50865ed862dee30d65aa129b3

  • Size

    525KB

  • MD5

    3b96bdfcfb1526637c8e102d025948fd

  • SHA1

    6a7f1d63c850f6b7c9ee7434030d78016952d4d6

  • SHA256

    afa34b3368467d6ef49c6b67fa3373db151ad1b50865ed862dee30d65aa129b3

  • SHA512

    50914d5fa1b8936eec7d40a864189ba0cd8a7d1d50038caadfc4c93f5f1a5d79e538e17156812deb661debb205f26ddc55e09946c9b8ca56152b3bfacff7402d

  • SSDEEP

    12288:FMrmy90lcl6CFoQiCRsB6thS2ubQdeWI1:LywDCCQjubMk

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1