Extracted

• • Target

    b20e511fdf1ce0d2d0aa635110a60d2350b8a892a5fbde8bfc9f21715b80dd0e.exe

  • Size

    526KB

  • MD5

    ad2e41af30aa63b99766bad009104b42

  • SHA1

    643954d4e076e4ddabf0c42fb3545c029ae91da6

  • SHA256

    b20e511fdf1ce0d2d0aa635110a60d2350b8a892a5fbde8bfc9f21715b80dd0e

  • SHA512

    d1517269106a01480dcf68d989510110237b572e764926a5558de9ff1e7dc453b78a19629c2ddd577b665691b3e05a71df7edbb37f380883b272c92cf3975d1e

  • SSDEEP

    12288:SMrny90okp3rPkhFUCjj1ph5qTE5bsAlV4t//8pLli:py/MQhFUQDqT+C8pLli

  Score

  10^/10

  amadeyhealer47d0a3adwaredefense_evasiondiscoverydropperevasionpersistenceprivilege_escalationstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1