Extracted

• • Target
    https://app.getmoney.tech/WMndFrdk?keyword=Other&cost=0.00200&ad_campaign_id=262704&source=470967

  Score

  10^/10

  amadeypersistencesuricatatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies system executable filetype association

    persistence

  • Registers COM server for autorun

    persistence

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Program crash

  • Drops file in System32 directory

  behavioral1