Extracted

• • Target

    670f6ecd6b0d21395476f2e2127575c406df7bdd11626b5d39ea76f70df28925.exe

  • Size

    519KB

  • MD5

    16499424f1c37c1f3c6c62be4ac35fbf

  • SHA1

    dbd2e1228bd22ab566e89a478964bedb5ce5d555

  • SHA256

    670f6ecd6b0d21395476f2e2127575c406df7bdd11626b5d39ea76f70df28925

  • SHA512

    c6e0f53c1a7ac5f31f99e68f77288eec78798bd8efd3984a71b64888509bcd59d90f4a74f57e47a120784fd4742237effbe734f70a4f939e03b7865486e35a84

  • SSDEEP

    12288:nMrVy908rGe/JhOFG1Ye3es2EFIj8qSf:OyFh7OFGCe3es280m

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2