Extracted

• • Target

    710bc8f2927511a24c7a42363c82f14810a859a235d3369e40a5b354a2870e04

  • Size

    1.1MB

  • MD5

    484632dcdc2d73b45386c2419e73f3a7

  • SHA1

    eaab3c3654f635afbe9ebafef52bb73fd838430f

  • SHA256

    710bc8f2927511a24c7a42363c82f14810a859a235d3369e40a5b354a2870e04

  • SHA512

    5e6079984a14066225043c02b42fbbb86f791bf6b36c3a715486fc3cfdab3cc777606f9c42c96269d61aa8fa1751a173091a28b54988cf6bd709b4f8d2c3fe6b

  • SSDEEP

    24576:syj51yzdy0tGksKS0mqpulw8ite85iPFc:bedhtGksKShq/e85i

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1