Extracted

• • Target

    3b64e343ec61a1cd7ac55c001e060b072fe020c78dd9841a21dab40b6dde0fd4

  • Size

    1.2MB

  • MD5

    7b16239bdc77bdbf2e4f071d0a6ffe25

  • SHA1

    c3faf448afc4baa0088d5fc939da18ce35882db0

  • SHA256

    3b64e343ec61a1cd7ac55c001e060b072fe020c78dd9841a21dab40b6dde0fd4

  • SHA512

    5e9effba6bf5dd4919530b23605c144a76459f638c325fecfbfa01a5a4928f46685d1682f38f495e5a74ae35b01fc2354435266e13a46e6d7908e1363eaf4866

  • SSDEEP

    24576:kyrOSm36Q0YVur+Bs+pkNe9hF2ZKmwzNytjD2A3pNI7NTSiTGQk/RdDn:zxA0or9hF2Zh2YtjSAw7NTyQk/

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1