Extracted

• • Target

    cacab12c2cbc5f9fd55b8b7f640f79210ed96371eeba7831aa82d665b657608b

  • Size

    896KB

  • MD5

    4d238fe1334e551ef35e3ef1c2b1fce2

  • SHA1

    679443403b19802d371a895e2e1437cfc6961282

  • SHA256

    cacab12c2cbc5f9fd55b8b7f640f79210ed96371eeba7831aa82d665b657608b

  • SHA512

    aed64f4f8287f9ff25ee3d4fec31093b784ee719c8cc72b01ea4e522a936791f469fa3b9f5d16cd0e4aaafa64e8b848d3a3eaec84ffa735bafffe540a42d96f8

  • SSDEEP

    24576:6yW/+qqMDXP/SiAsZE38D/2aJfdkynVXqxM:BcquSiPU8D2a/kyx0

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1