Extracted

• • Target

    2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459.exe

  • Size

    416KB

  • MD5

    f5d7b79ee6b6da6b50e536030bcc3b59

  • SHA1

    751b555a8eede96d55395290f60adc43b28ba5e2

  • SHA256

    2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

  • SHA512

    532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

  • SSDEEP

    12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco

  Score

  10^/10

  amadeyec08f7discoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2