Extracted

• • Target

    d039b982275d6243472be4a573259f4a1b4c03d5c6c05c8230bd5ae855222582

  • Size

    940KB

  • MD5

    1d4a985dc80e96261bb9d08e765d2404

  • SHA1

    6e8cb6cf4f6191c4c0bed1522d571098bab6ec79

  • SHA256

    d039b982275d6243472be4a573259f4a1b4c03d5c6c05c8230bd5ae855222582

  • SHA512

    7c1ffb9ef71384e6077607b875f0a10369eede61db5e1bce335191937116a2b18d202f28362c0e76086eed98f6d2b72797532db55aa41e59e90fe52c649f7978

  • SSDEEP

    12288:1y90asC61Qh3WY/rskZA8XgDCOQvwriSeLjPxgUMLZoeOi7WNQFm18juKAA+VpX:1y0gkCWS/36UO3OPQFm18juPhX

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1