Extracted

• • Target

    39756d23ff5ad13e0cb6db860ec44d0b61b43a6c0e20dc6f13a8135a1e977c28

  • Size

    1.1MB

  • MD5

    6573abffa25c7eec0b8d5bc1cc15b856

  • SHA1

    df9a436ff3540dbb1cbc0d1cdd8424bf22fb9188

  • SHA256

    39756d23ff5ad13e0cb6db860ec44d0b61b43a6c0e20dc6f13a8135a1e977c28

  • SHA512

    d3d6d2a2baaf31b70fcaa46eb735cdac6453b6ddbbf323a76079a32ff89a1991b4e52f9ad004518e8b28d12b12e6d36f7d7a8750900ad76deac32c17654d0e98

  • SSDEEP

    24576:aysc4SLCZ9NVcoL6ZQiOa3TEEeGw9gPjWrqEUCg8St:hsf3fAZnfTEEeGw9gPjWrQCg8S

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1