Extracted

• • Target

    d0d8031bd95d8d4789841c830451bbb6b8f23150432d50238b2059200ba2b629

  • Size

    1.6MB

  • MD5

    ec2a7f8c0db69ac11be370b138907c11

  • SHA1

    6665022222550a6448dc13ac0eb790dde52ff70b

  • SHA256

    d0d8031bd95d8d4789841c830451bbb6b8f23150432d50238b2059200ba2b629

  • SHA512

    9bc2a28f1029f528c9da5e22f1114d828e8b551dab5d829197961c06098c80c356af5abc9bf261a8af433c0f0833fdbfe21fd715cfb15c650e52eb25df211b11

  • SSDEEP

    24576:ayGfCeWrb8aIyXOog0mhsoMFcqSDHO69kV+UxhF45wgEzwV9pnp4l88o+w4liea3:hz7f5vOn0mhDMSq8kLhmw44l8ZR4liL

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1