Extracted

• • Target

    5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf

  • Size

    1.1MB

  • MD5

    79da5f809a554c555e9692b7fb420932

  • SHA1

    d46ffbf60e8f09da407ca40c0d0da92bc5f764a1

  • SHA256

    5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf

  • SHA512

    f401c280a98887589af1cf678c90d46d917c4917d23aebf82f828ef5708ea28ed1ac8e8c73803adb9fcd5f30a4a148b642ecdf9631ce81fd4e9d59195fc96ee9

  • SSDEEP

    24576:hyCoQ7GwtkrpJ8Xh0zASB9cP6tI2ivwdvszT5uD34R9:UXQ7GwtkrUXCzAwc++y0zdu7

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1