Extracted

• • Target

    14a3d843a9f629390d09feb036a7d748aded0ba34fa20051721a08e1f8f7c337

  • Size

    696KB

  • MD5

    495dae43abfef6cba51f8ac26f907373

  • SHA1

    bda242983687626e8e49f56911dd67e41b0cf36b

  • SHA256

    14a3d843a9f629390d09feb036a7d748aded0ba34fa20051721a08e1f8f7c337

  • SHA512

    deaca98faaa0f42fe89a4985f1f8749de9ba036c091d542b28853e73958ba777a1c24ed7a7403c8cae0af1d6cc611a33fa590fd4e4abf22fd255866358ba9fc7

  • SSDEEP

    12288:4MrGy900scy63aHz2MLbMzdaF8e8aub790VwNg6TcpFuWZgU:+yvyrzzLozne8T7mVwNg6QpFJZR

  Score

  10^/10

  amadeydiscoveryevasionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1