Extracted

• • Target

    y6198000.exe

  • Size

    234KB

  • MD5

    1580a52a4b26f11aba77f2039012acf0

  • SHA1

    4c2c491fc2df2bda9989deeee189a2898b62526a

  • SHA256

    c4a4fa4690d4ccb274cdd0e0bf2b60b47461942b3fcb1eab4fb6fcb508e1cb15

  • SHA512

    035f1b2ec75f12b07f755e0ba2c4a05d568e8670ec7fe7ab5f506af63543f7773f191405272d51349af034efb93159bda8c3246e7cea4e58bf51cf934ffe6f61

  • SSDEEP

    3072:KDy+bnr+O1p5GWp1icKAArDZz4N9GhbkrNEk1e6D5dMOt7WQqmuXIsjQoc:KDy+bnr+ep0yN90QEjzDQqmSv

  Score

  10^/10

  amadeyhealerdropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2