Extracted

• • Target

    Dynpvoy.exe

  • Size

    1.1MB

  • MD5

    c5ad2e085a9ff5c605572215c40029e1

  • SHA1

    252fe2d36d552bcf8752be2bdd62eb7711d3b2ab

  • SHA256

    47c8723d2034a43fb63f89e2bcd731c99c1c316b238957720c761a0301202e05

  • SHA512

    8878a0f2678908136158f3a6d88393e6831dfe1e64aa82adbb17c26b223381d5ac166dc241bedd554c8dd4e687e9bee624a91fbe3d2976ddfea1d811bf26f6d4

  • SSDEEP

    24576:ointVUQ6nNORVNIW6/HPGs6h3RPey7PlLUPe3Oj3IyuFtx:oinvU5nNO3NIW1fNAyrlLyeO30tx

  Score

  10^/10

  discoveryamadeyb44aebtrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2