Extracted

Extracted

Extracted

• • Target
    setup.exe
  • Size 10.1MB
  • SHA256 7cf5256c29c1c8ebf4e8322f049e751831eb2b5c23a50a784a1edf93f8b1f37f
  • MD5 d7e4cccaee96d1403d808decfe56030d
  • SHA1 df8007725c1d9726dfa7249e7b167f6c649e354f
  • SHA512 0d5a136d645afa1f6a9db14ad547cfa5e6085db8ac282c3e7d3204fcec8d7a5675fe32fdabf2532c85606a539b3edd643098dd138280f79035eaf861e2de68d6
  • SSDEEP 98304:kQDTI1gkmCNbquwfEyZoYouYik3CUVkoVxeIke1oGy4IEitn8:Y+kxbqlfVZo7uYiXUiIZvctn8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  74a65bdiscoveryexecutionamadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3