Extracted

• • Target

    af55382339c3b253fa9832bbe3c193779287fdb7e4ca0d09c8add1c2f9e8cd39

  • Size

    1.1MB

  • MD5

    aadc428f0fc2ebe568c74e09b6509c1b

  • SHA1

    c7ac3fe245db9edb7303e24572ebdf4c21341270

  • SHA256

    af55382339c3b253fa9832bbe3c193779287fdb7e4ca0d09c8add1c2f9e8cd39

  • SHA512

    09933d5d8fe51d5e2d489fcae3df4f18b4fa7e0972287cab62e80f373e4f27b5f2b5d73dde14e26c6510e409f67630e36988a8a2ddb2006c5682155fd26a5e1c

  • SSDEEP

    24576:nykBXwp0+pDRq6I1luf9WNCWmoizdTeLo9aP0GZ:ykX0NDRq6I6FWN3izdKL41

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1