Extracted

• • Target

    aacf669866c69553c2983113400fd433.exe

  • Size

    8.5MB

  • MD5

    aacf669866c69553c2983113400fd433

  • SHA1

    7d7a8c49b2ed28f386351c74f590559eda609058

  • SHA256

    629c71be115db2a37c97087d5aec82351dbe505523fa6d520e88c5dc8a98858a

  • SHA512

    b4867e93b75cb5a8dff0e41b0153f13e4e9a2369fd87cf57e8619fa3d7399b10b29d8cd571cbeef46b052274e055c377379c3f96f13fdca802acd04f8a49881d

  • SSDEEP

    196608:ZuvGaLYgMZrsB/JvhpACDMR1DJZH4RIBHhfqXs8Teya:ZuvH0JZrkJLAyMR1D/H4RWhic8TeP

  Score

  10^/10

  amadeysystembcpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2