Extracted

• • Target

    tmp

  • Size

    231KB

  • MD5

    3dd072d71907f6d5a5b046908c081f11

  • SHA1

    6432c3dacb6e4dec30ad44cc92f79d4a0156affd

  • SHA256

    1783a69593b72237fce4111d231ab3c919f9220e8baf8b2216c488d4dbedcdf1

  • SHA512

    2f6a4df887ad59e8b34644e8832f843f0f3c84171dbd8ceee9e1ec348684ba43a7ab4f2864464e343c8a17bc147839add11c939dfcea4fd60f79f48b89010453

  • SSDEEP

    6144:0s9bFCavQJdMSzPgI0KIikB/NiFEZu7dRmV:pbFCRMcRIiTFgu7dR

  Score

  10^/10

  amadeylgoogloaderdownloaderpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2