Extracted

• • Target

    cc61a43550b1746620cc6a2648fac1334088bf70e454b463cc77699b352df778

  • Size

    854KB

  • MD5

    21c622abb5af3f8e756b870a30c91bd7

  • SHA1

    98eed7d31a3d5a60e3c3e58e5bd12c4d1ea6846e

  • SHA256

    cc61a43550b1746620cc6a2648fac1334088bf70e454b463cc77699b352df778

  • SHA512

    f5929ae6102e8377a89a995d8b5e557ab2bfa322d6d9a5b3874a0b841b53c4901e91cf9b2852d8866f19de45585d3d88599fde1ad113568cb4fa72080ddc929c

  • SSDEEP

    24576:SyHQmwf3w1wxNtyjgZSvp0sU+M3psNY3:5bw/ow1ZSB9u

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1