Extracted

Extracted

• • Target

    file

  • Size

    1.7MB

  • MD5

    4734e393c969f8b3ff8e2920d219d019

  • SHA1

    d4c55709c6245046d98f9e2f97590bf5489b7f62

  • SHA256

    adaea581d959a8c0e4a570708711cc0a4112daa9ef8d47d1f5dafe486a1b32c2

  • SHA512

    471c73574428b51e582caca5a00d502e02ea07cbf03f5d155c340270563c88abf9f9ac8112d45a28a3def92a9df391cff9b196dea83c844736f792e38411f2fb

  • SSDEEP

    24576:4yAA0NUSRSM2qaCRG18MiJ+XXHvSaKzjuPbetqkTtKl6OsBsGqcLjgAJs4K5/:/nM2qFUiJOXhKzjuPs5u6OsK4oBN

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeysmokeloaderbackdoor

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2