Extracted

• • Target

    9e243b65e595b696befd8887ba388316a8c674c5b89b1d6b8fb8b3727bd786cd

  • Size

    963KB

  • MD5

    5bed2c1cf38e25c5ea41b280380fda66

  • SHA1

    3922c22309f943b70a7f12257adea73136ef7fed

  • SHA256

    9e243b65e595b696befd8887ba388316a8c674c5b89b1d6b8fb8b3727bd786cd

  • SHA512

    3958c6e005e12e1c400ee10e11e0d8c80ba66faf2bc691438d522b35dbdbbf03c64b11e96a2e9a353a3b7e839d7b131bbf5d002f86f5bc573deda824d556a3b1

  • SSDEEP

    12288:b7j+zRQR/zzOFEhkI85dmiJFldo/XvsF+6iaguJX205V5H8VGQOZYffgpHEVxRoq:bfEQR2Fh/nVFEX3HagSIzZ

  Score

  10^/10

  amadeyf9a925discoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2