Extracted

• • Target

    04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169

  • Size

    1.2MB

  • MD5

    f9ab58c5afd69c8ef1d630463fe1d9d6

  • SHA1

    d296c55953a0128172cd21208fa06aa0626b0c80

  • SHA256

    04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169

  • SHA512

    0106d5672e43e2b676fc0a5d465118efefe51cf3655c8fdbf4fe383d5fb6be7b3bedeb0861b1a0f2c98d2dc8ce9aab8aad664624184a9d6e887276f6abf03372

  • SSDEEP

    24576:ZyJTD5IaXAHpS8WJdMvDAnFznTW/ujNTBOJDdeCWDq1U:MJTNtXAVIFzny/uhTBKeCV

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1