Extracted

Extracted

• • Target

    2612db60a87d252d98301a3f3eedccd0.exe

  • Size

    359KB

  • MD5

    2612db60a87d252d98301a3f3eedccd0

  • SHA1

    cfda352237351c429036d78acecb97db0e46b667

  • SHA256

    feccc34d9d5d89013d16ab7b5cb5437575ec915237b67fd4e48326dd9d41a54c

  • SHA512

    44f470d44d81775a5378399793bf9aa6d3cf0ffc450758a315c29d7fa0b7c12aecd236b5e38d202ad5fcb4f7fb9c28c529da35be6accca5f3ad8ae58c20cd112

  • SSDEEP

    6144:KNy+bnr+Ip0yN90QE5WXSkgXmmhqbqWNhRYDlB8em1NUMkv2/SwOIBRHdJaVuye:rMrAy90xSbqshRYTWyxIBBaUye

  Score

  10^/10

  amadeyhealersmokeloaderbackdoordropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2