Extracted

• • Target

    027c10bbc333e8fba44b1b4ce29f92866c7066f6538aa40f31586a4b9fb7b695

  • Size

    1.1MB

  • MD5

    a2b36a68a7d7dbd909b75068baa72f73

  • SHA1

    fda976e408eabaae5a33fe8d0db10f2de08b99e3

  • SHA256

    027c10bbc333e8fba44b1b4ce29f92866c7066f6538aa40f31586a4b9fb7b695

  • SHA512

    680e434e99eee59ec8b97e567c73ae2468dd08105006b09c65fde6dc2c20eda3e55e3b58d0061d042cf586a8a37c4c301a116fb2e5ac94880242a015dc31a1fe

  • SSDEEP

    24576:syAj7nidpShhkzKJZmfC4J89L+6/SWV/ER2UFac:bK7idpohk2JZmf3Jo+6hVsAUF

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1