Extracted

• • Target

    e0afe22b5369ad77d29600482f93a66f4fcf3fa39de06ca8627a7e7357e0578b

  • Size

    1.1MB

  • MD5

    a4cbe9ab288ac00374553754f553dc3c

  • SHA1

    0a4623800fe55ca5204ef5428c40c77d417fa4fd

  • SHA256

    e0afe22b5369ad77d29600482f93a66f4fcf3fa39de06ca8627a7e7357e0578b

  • SHA512

    25bf38bbb538167139a47419734cf65f8f52dc78e126f7d5c659bdd63bb868dcd3d7a81e64a2d3e9e22fff256bb2c37b5325ee19d7566f3df336436db4792cd8

  • SSDEEP

    24576:wyhMeUqZXFFlwjNAALcbkFgI7MrHopKq7Cl9iIFdJvFt:3hMMqjRL6+gI7MToT7ClhFB

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1