Extracted

• • Target

    faab13260a6fecf8e125553a2a4f423329f05cf0d7ed4f2df70a1e9810620f97

  • Size

    856KB

  • MD5

    d3c3d8fde9b072bf963e3cf659fe6272

  • SHA1

    4d6e3ef223c9f21d36679cd089875243c8d5db7c

  • SHA256

    faab13260a6fecf8e125553a2a4f423329f05cf0d7ed4f2df70a1e9810620f97

  • SHA512

    a438407f3584ccc42939c10d9bc23ec9d5e7ac265879e7e5e12deb1aed3bb603784f0d78125057094ac5a0d0c5b62ffffb00a9a17bae2592d4eaa7f6f59c9c24

  • SSDEEP

    12288:iy90oiSuqJzKXOPl5b0T0whFyVC3dWfXoftPrT7DThazxXBiXbi:iyhiSunekTlFywd04FLvO1i2

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1