Extracted

• • Target

    y1950700.exe

  • Size

    234KB

  • MD5

    344a7135a763c2bed59738d96c0b4cda

  • SHA1

    534b3e2f176851e17721dc1919720442b781d1cf

  • SHA256

    49913d426048f5eb059ff2bbb03a583818076b8c4f9088d8042e3887d1cd25ce

  • SHA512

    a471574a81306d47f8da3adc9283d314b6d812b63eec5d9f8d5d0d2731b58baadcfa688ebd3dd953c98aa1a99320ef57de2c587b2f0e4c9764ca05ee91bf650a

  • SSDEEP

    3072:Kmy+bnr+O1Z5GWp1icKAArDZz4N9GhbkrNEk1g6D5dMOt7WQqmuXIsjtoc:Kmy+bnr+2p0yN90QEhzDQqmS6

  Score

  10^/10

  amadeyhealerdropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2