Extracted

• • Target

    1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.bin

  • Size

    1.1MB

  • MD5

    981210792c9d44c3d91282861f788a19

  • SHA1

    b826986782b558db6a91537726fcca1b65827db3

  • SHA256

    1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c

  • SHA512

    2c878363e7317e1da935f9d698a490eadd69abee424e8deec9b3787c878e90f472a9faebbf6dd405ea37d09f52df3633d41f9e9d9ec37ee18fd4eab2c9827e3f

  • SSDEEP

    24576:ayh+gSh3ZUwzm3oLtRRjna1YqInSYBicEc5OPXNmL+adJ:h8gSvUwzmMt/KYDnSNc5OP9myO

  Score

  10^/10

  amadeyevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2