Extracted

• • Target

    394168b2f2cb33908bcb50ce185fef5a_JaffaCakes118

  • Size

    4.3MB

  • MD5

    394168b2f2cb33908bcb50ce185fef5a

  • SHA1

    f89b384d59cdca8b2ab4463686b488c4be95ade7

  • SHA256

    07a57e3b4dedb68cd543937c8f3c1074898c1ef7ebdef2500ed2e21e90adc876

  • SHA512

    2fef618e41c30d18b79a07bd23817b898ff7fad415d51faa5d6e58cd2e6f3cb8abb431eebf913696ba3aebe3e893c3b1bce98942a5cb5b513da743d5c21e5e86

  • SSDEEP

    98304:Ci/oJUas6k1aTsRzK/1zVJMo+HhfgomwZMvQmQJquCuQGDJlrEQANECdK:CP+aZ/qfgSZxmEqruQoL1hCdK

  Score

  10^/10

  amadeytrojanvmprotect

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  behavioral1behavioral2