Extracted

• • Target

    57fe95c40d83f395bad243134a47ac8af1a322c7d246979562e2574036da5661

  • Size

    665KB

  • MD5

    64f1d67b14dafea71c599e9c5498edc2

  • SHA1

    6099ea6ef4fe0066c9d97822402878966026dae1

  • SHA256

    57fe95c40d83f395bad243134a47ac8af1a322c7d246979562e2574036da5661

  • SHA512

    280039151a826fea1cdbcd7c4b12ac3af7dceec5cbae7ba897c3fea0ec0ea4a3e66449a242d707e5552fb712cb4e85b62329101cc3b8df4d913c03646b23881c

  • SSDEEP

    12288:plKxWCF+i/o4m8mMLkV4dz62TigPHRD/cYWqBGspdHtK:plKxWCP/oRMLDFpigPHlkYWpEH

  Score

  10^/10

  amadeytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2