Extracted

• • Target

    1b5803f66b61bc627b323bc2a5cac0b40527d214ee4038b28d22614844523ea1

  • Size

    1.0MB

  • MD5

    7ddfdb0e6901edbfb8a43c3aaf12da8d

  • SHA1

    6fbbce929fd39a980263c8f725da1a108b3a1031

  • SHA256

    1b5803f66b61bc627b323bc2a5cac0b40527d214ee4038b28d22614844523ea1

  • SHA512

    4db31bb5c6c7f30f257912fab1e1d33de66b3317f1ee0a00bd18123b69d5f7be2e2fb966e7382b96af977612a5d32d922027c2178cfc5cc67731f20605b5a8c8

  • SSDEEP

    24576:TylyOOMjUHZRrw3GQu7YI064T73JTA0c:mddUHnwW9EI06Y3W0

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1