Extracted

• • Target

    102d620cab4d47fbc48749d611e8cedee82c311ea6f8cc9391788d5e3229b41f

  • Size

    340KB

  • MD5

    36bb7b15188015a9244192574039ac30

  • SHA1

    81b7f1af7139be6c7285c06c5e499991a8f74469

  • SHA256

    102d620cab4d47fbc48749d611e8cedee82c311ea6f8cc9391788d5e3229b41f

  • SHA512

    d3a81f49879202ed49d8c8e009841d2456445231781fb9a3838b6b8a6d7c96b0139fbef1b1465351c373dcd72776328834966a1fed66bf976e7d5842dc0516b9

  • SSDEEP

    3072:UUx1gaqJk/0ks6k1y3pQXaeC+ayyPvTkmtHqcn4eX5RQK4UNe1x/htE7:5x1sS0k7j5yatXVTFIyQttRt8

  Score

  10^/10

  amadeyf9a925discoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2