Extracted

• • Target

    file.exe

  • Size

    521KB

  • MD5

    6aceca2b5dc212692d307aa30e1008fd

  • SHA1

    efb540f368679fd7855bf626de5d1b9fde7a0506

  • SHA256

    2da074373035de9f363c524ecab2ce96380b732a4c505b9ffaf9b5a6905faa35

  • SHA512

    6576cc9c5068d21b0a5e2b374776a2b67da05aee42e030e58c162b9de1c4d4449366653132e84845a14838298eaa2bb220535b8b3c66394ab7db0c1c77fa6844

  • SSDEEP

    12288:MMrCy90Dp1eA+zZsYsjaV2LYUOqRUk20cQFhA:eyI/JjixHqRUk2+F6

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2