Extracted

• • Target

    fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb

  • Size

    9.0MB

  • MD5

    12e8f6cd7924fdf8d5557c2f2e4cd3e4

  • SHA1

    c9d25c9007480dcdc7dc49b519dd2f61c5a5b22a

  • SHA256

    fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb

  • SHA512

    31b322f3f18892831ba1c24dd0eccefbc84daa7894749cf6bb1ba06558cc7f8ae248744fa0e0946beb56eb34048f6d34a1fb9ceedb9d5ea00e2ff796e6249cc0

  • SSDEEP

    196608:NA/TcGrPnA36xgX6OtTJ/jKcoL7P50dkmkjk9hhWZovwMJ+2t:Nuc70yiJFC1oMht

  Score

  10^/10

  amadeyc15c21discoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2