Extracted

• • Target

    Factura-Digital.7z

  • Size

    7.1MB

  • MD5

    551db99ee591cc96a7eb9cb2d90ce3e5

  • SHA1

    625b7ed0d937fc5fc4a03433104ed326facc7074

  • SHA256

    630bc7e23cc99472759d6c778c0ff57f07f5b5e0af4806c0e4fced953166eb60

  • SHA512

    f1afe7c69e5344b60339556f9d4062494828125cc7a1e5b87cb6df6f9cf779ab2df59c5d3f9214a8321a7c953376e42b458a3b2b652a0e93943d2f1a1982a3f6

  • SSDEEP

    196608:Ny6qg/nmMEduyQPanOZamIkVDlKQt9ajUYhen8:HjgduyyaWF1YGBae8

  Score

  10^/10

  amadeypersistencetrojanspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2