Extracted

• • Target

    4ae0b20b050318a0dd7e2e6fb09e0db2096ae6e81775d29595dc98468ef3ac99

  • Size

    1.1MB

  • MD5

    406b114d4dc4875de989f6e018540f54

  • SHA1

    b27b65bc8dbd8f883c54d94bde9282d0f23ba7b2

  • SHA256

    4ae0b20b050318a0dd7e2e6fb09e0db2096ae6e81775d29595dc98468ef3ac99

  • SHA512

    04d0359b01491dca54e9a07c5f7db5dacaa140d4ee2bfcf3f9910af41375fc0ae408fd34a4ee2d5d7f692e7c196e9fba1d3659666293c67fc47b13421fc86d7a

  • SSDEEP

    24576:Byq6o89XVR6hefvTDwyuLWqeYbEfioxIhcdzG9+D:0q6o89f6hefHSCgboecBF

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1