Extracted

• • Target

    6cb4137cb7e29807e2044a791bde68687eda33a963906bc6516ead304075be56.exe

  • Size

    589KB

  • MD5

    0f3eadc3ab8541461b82a4cb7a06d2fd

  • SHA1

    98768d1dc1fd7a105c37a2867a57c6ea098a0afe

  • SHA256

    6cb4137cb7e29807e2044a791bde68687eda33a963906bc6516ead304075be56

  • SHA512

    f6a51063d1deeb496ac7cb963a76585e4fc5ecfdca3a849b1f91efeb042c559834e6ca74b98b3e03f33d82379a43f68b28fb320985121189c8ff101610cd1028

  • SSDEEP

    12288:yMrcy90/R9/Oi6+TuHl0em1kqtKmENNfgAchF+DThTFDt2dYS1U5alR:KyE9/7Cl0aqtKFNQhFuHDcddMalR

  Score

  10^/10

  amadeyhealerb50502defense_evasiondiscoverydropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1