Extracted

• • Target

    v6240371.exe

  • Size

    359KB

  • MD5

    fdb89ee30e5f00c8a2dc170e819a4ddf

  • SHA1

    7ddfd3aabd1dcd7624846f883978f78e460466dc

  • SHA256

    3456b77611c137ccede6291ae88dca2b535ae5593c8842db3cee8c9742f3660b

  • SHA512

    13ac85d2103ca8bb5c95565a1ec6fa7781fc88370e0a718b89bc1171fd3d97e381d5a901eac258a8a362215f0a8fc0227d32bb50e1d1d58586c7d59faa3808c8

  • SSDEEP

    6144:KPy+bnr+6p0yN90QEBFGjRBpQR7FiVm4deHw7qyP5cBP6tmFV7oyGWmM:hMr6y90jF2VmFsUQeyP+QwV7oyBj

  Score

  10^/10

  amadeyhealersmokeloader88c8bbbackdoordefense_evasiondiscoverydropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1