Extracted

• • Target

    63e53823413533873fece16729aa5643022630dab47257684a1d59598da40266

  • Size

    1.2MB

  • MD5

    f1e4b3ff59e55c1642cd641f349edf4e

  • SHA1

    fbcb9c20e8d8029418be380fd739b6a14c19e38d

  • SHA256

    63e53823413533873fece16729aa5643022630dab47257684a1d59598da40266

  • SHA512

    d7dda5d651fccd5d4bfad65c6b3d0829d9d22a9456f468dbfa96c02cb1d32fa16f2e7b7da1737f082753bf0eeb3f0cd8e879c176f996bd0d94dfed9ea81a9d30

  • SSDEEP

    24576:myYebd0t689qS6tLvEEBeqa/iO+JNPWQrY1lO83S2ABs/XU0lma:1A68USsL1BtUaPWzwJzs/XN

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1