Extracted

• • Target

    165a8064798a5537d554410c13911f5bfab2378386da7e1d3791c56195cb8c54

  • Size

    1.3MB

  • MD5

    56bcf63a381be768573ed0e866a2613d

  • SHA1

    2974f5b7b0c3279b1d4496b60694fa0348671269

  • SHA256

    165a8064798a5537d554410c13911f5bfab2378386da7e1d3791c56195cb8c54

  • SHA512

    1422448df87a822d365403aedea49bbabe8239907cab99e34a2d23aef5924629afff152a9eab97f7933dfe44998ee65e2be5284346f13a6e52d515ceb3a66615

  • SSDEEP

    24576:7yytWeQJhSQinRRP3bxGlgOjIVbwYQWVp+Y+Xz2RQkqc8k/I:uyt34SQqRRvbxGlgUBJo3OKRJ8k

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1