Extracted

• • Target

    99cb969e-5c61-4204-9902-f21da96b8e7a.exe

  • Size

    113KB

  • MD5

    86dc268e1263407b2a5a1a8f874d282a

  • SHA1

    a4f0cef3711c85a65c43b27025bf373f10a84845

  • SHA256

    974a488f846e09b83c1ce8224d649e229561e6f022d31ff01a6438ccb1e26f8b

  • SHA512

    e792c226f23a04b692bb378ea3da6f5fbe6789e213e46c8316d6f684df7d5f28796f7e20300c8de853455d0a1bcce27ee0191ccc716195fef2717b20272845a6

  • SSDEEP

    1536:Wurgu5SIr4FidRnablY5Rh+iqBUQMdzb:Wur9kuPnablIp6hi

  Score

  10^/10

  amadeyevasiontrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies security service

    evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2