Extracted

• • Target

    9a41d33683ee537a8bc637dca63c03788759889f7d2687df3346d383b1054f29

  • Size

    1.2MB

  • MD5

    04238299ab12822748ded33295dfacbf

  • SHA1

    d3e9b6d62f47222ef31645e72ded0a1930d2a66b

  • SHA256

    9a41d33683ee537a8bc637dca63c03788759889f7d2687df3346d383b1054f29

  • SHA512

    764f0678d2d68789f3cb3755db4fc442b88ac0705f5fbb07edd53c4097cdedf3f398ea425880c971127b8d22dbc25e327d5c8e0d18cd3b110a060f3d34a288f6

  • SSDEEP

    24576:FyIG7e4RD89QEXw/KiTYct+o8mV7iUm5v4yYQ0wcUVA:gR7epa/KPct+oRiVvbPTRV

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1