Extracted

• • Target

    52b3fc7b1d144f73d353974f0b5b6f015cdbee8c3034b9ec6a67c6dcdf511714

  • Size

    642KB

  • MD5

    1bed6113df00bf946a87d60e4f826d9f

  • SHA1

    f5bb82b2a5bff11ba6c779a7c76798d884e02e25

  • SHA256

    52b3fc7b1d144f73d353974f0b5b6f015cdbee8c3034b9ec6a67c6dcdf511714

  • SHA512

    77e070b4763fc027d015cae0a374aef25c0d58f8978925de8e4c889eb2f22c01e24969c1ec4e5cae3d2286be2c55900d6cf4fa8ab6f73f5094d072b5517ee8da

  • SSDEEP

    12288:qMrDy90VPKqaShSbB8XA7Ip0Kl/pjNoQCHETuK2mw0857nl:NyOPK7ADp9bo/HETbO0K

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1