Extracted

• • Target

    5afe5c03c2fa50e0083bfe5244957690c0fa4bfffe17d44f35f1cfb44bef1723

  • Size

    944KB

  • MD5

    c1643ce032f107dbbab83142f56a79b1

  • SHA1

    3408097011da9f28fa898a33e6e2f233e6c830f8

  • SHA256

    5afe5c03c2fa50e0083bfe5244957690c0fa4bfffe17d44f35f1cfb44bef1723

  • SHA512

    4e3653a12af66f4e35ca5dbef5e55aba38a502305ff2a251f8de8a89c182587ca3a2bb1ccd07f33fdaff9aa34d4150437eb5924c53c26c88539d74cdc594e349

  • SSDEEP

    24576:tyhJfVXbA3f0UU4RTbjfDwjcb5RgCDLcCioGQ0TH2hLm8zLQ:IXRk3f0UlRfY65hLcro1UWU8zL

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1