Extracted

• • Target

    2c96bfb1c82db027a22f9edaf5754c458c23daa33a42df0cc8eb5cc169e140e7

  • Size

    1.0MB

  • MD5

    24ebcbd01f1f57ddd37faaae771b28c4

  • SHA1

    d6b7b07c1201b8189d3c824aca81e0c8bf383b7c

  • SHA256

    2c96bfb1c82db027a22f9edaf5754c458c23daa33a42df0cc8eb5cc169e140e7

  • SHA512

    1ffa95718fd3181618ae485759dc60056980fccd5c9025a0350141089a5d7cb36e92f04691d7070724a67ea962778d1d28ac5f3161effbaf0f52fcf93fb0544a

  • SSDEEP

    24576:1yBcSqZIZ4Dz8KVX/zVpyg0kXIv8qkzrisqG/b+JVnkXgBG:Q4IZ4Dz8KcgfXIv8qkzrzqG/Knkw

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1