Extracted

• • Target

    912d72c57e5aca94c54a47000a625601edda5938ba23ae989440d33de5925980

  • Size

    843KB

  • MD5

    935bf9156d20f4603d25d5af53c60790

  • SHA1

    c93a40ec04db4f27ee127a0c4297843353e72e8e

  • SHA256

    912d72c57e5aca94c54a47000a625601edda5938ba23ae989440d33de5925980

  • SHA512

    cd56f94da02c1fafc98de1afab01635407e2af54dbec4d7ad1d7e562a10545e35e83e98d2b147f289b8eb559ef3ff12b3c51af0fd33c4bf2c9dcad456717fb27

  • SSDEEP

    12288:ey90VXQAu4fa42xYENhqlxmvTWhTEX2pXJAluPBAFisKxMfjCb42+:eykHuBhapvuEB9xMfjmD+

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1