Extracted

• • Target

    y2599304.exe

  • Size

    234KB

  • MD5

    75bd733f1592c1bfade85b53372629a3

  • SHA1

    28cfc227186b930aed2ff5a1d20c322bb17cacd3

  • SHA256

    787f789b469f47d66b3a5198b5b243ae24b510c9e9577d0d9e571786d2d1b1f9

  • SHA512

    7c935d8f5df5c8bc1c2fe96b293d21ee6b8e1da412f6c14b5f3c8f7b9596987055e56e725588bb05e25b15d082e98c0028b6d1c622c8ea8437bdbe72390ed134

  • SSDEEP

    3072:K8y+bnr+O1B5GWp1icKAArDZz4N9GhbkrNEk1w6D5dMOt7WQqmuXIsj/oc:K8y+bnr+ep0yN90QEBzDQqmSA

  Score

  10^/10

  amadeyhealerdropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2