Extracted

• • Target

    370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

  • Size

    1.2MB

  • MD5

    a488220463f26523fa8765aa57390582

  • SHA1

    e53f8b82f31580dc20141784ee4e14608a03aac4

  • SHA256

    370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

  • SHA512

    65baf891d73c99744e405fad2474ba40f786763e63fc2884a07e3308d74c2a2c215cdaeec8ae287c561971b3ee56d86ff90194f8838785cd50b27631d8fac85a

  • SSDEEP

    24576:SyMTSLrpx+3pP7oTBGTwmp61OnA04WFblVvtkM53qBgk0ppv1YT4jSZw8P:50Qs7uG8m61sA7WvgwwbSpvK42Zw8

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1