Extracted

• • Target

    file

  • Size

    520KB

  • MD5

    05d6eead50762e19e931255fa27c4f2b

  • SHA1

    ef55689dd5a4194b1405f38a2ee4de70cc277bb8

  • SHA256

    9ccbeb9a6248a426ca4b0e23ba99e0da817a208f89fd1042ebb783df292750db

  • SHA512

    481c6c64d80d1384b84962da37466bc98b2a2f1fda046ae36f7cfdbd0a02f29b0921054a591efdd2f4c05de3a44921ebf210e1ff47a1c11a4cb3a35a57306353

  • SSDEEP

    12288:MMrmy90WpXD2lynULiAvs6Hsjaw2WYUOqRwTdBPt4GT:6yRKlyJAvtMjLwHqRwBBP7

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2