Extracted

• • Target

    file.exe

  • Size

    525KB

  • MD5

    5d0b74c321e63d7bc0cf0f4c37a1d744

  • SHA1

    8e7c733cfd916441fee7bc02d660cb1eac93b562

  • SHA256

    d6bade6570fd73718c146a7eac69e3f59577102a9657611399a7dc27aad3a487

  • SHA512

    32c6a7ba38652bd09aac0180cb48c09a413b5d1f4c059bd9e1cee11435e6c4d21f5808ecaf6f086b2e2cfcc0a93501d4d79ee0236a61b7daff4c0a9cb9cc2b36

  • SSDEEP

    6144:KLy+bnr+9p0yN90QE3IbhjFVdIrsMPxR60zvz7ffbTAJEw5oGGeCUsoGKQsQt4VL:9MrJy90lI5FVpMOov3fbI5oGoUGSFGI

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2