Extracted

• • Target

    amd.exe

  • Size

    437KB

  • MD5

    625cb97439daa80940791f626bb4765c

  • SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

  • SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

  • SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

  • SSDEEP

    12288:C+mHU45lKN78RhFkvULfYOmBpumeYDDtKf:Ce45lKh87zLwp7Kf

  Score

  10^/10

  amadeypersistencetrojandiscovery

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2