Extracted

• • Target

    a4670b58eb8dbb0cceebcf206d515badbe6b8a3d34f979f938cb0df4c48e6fc1

  • Size

    1.4MB

  • MD5

    ab71fbca30c98fc3b04ed7df877223fe

  • SHA1

    f049daea83d7ee5acdcc003715d602c27f16cdc2

  • SHA256

    a4670b58eb8dbb0cceebcf206d515badbe6b8a3d34f979f938cb0df4c48e6fc1

  • SHA512

    3109aa906575f7fc7dd44523fe92761ddf56ade4a8113dcbaa709a444c935bee1874ba74c931efb811967ef4a13b2e0fea801895d22415aa903e3054e5571b47

  • SSDEEP

    24576:PyvRRz0ytExZy9p6TPJOKMmjuvlVDJLCDI4Ld7c7Ft/FE++KUPvNMUnRBeuLKC:avTgYEHKpQPdRuDp94L27FNbPU3NHXN

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1