Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 2.4MB
  • SHA256 44f009ca786bc541cda11c61bab7b272e96ce9e3d656c10bdac2e126f3a9cc35
  • MD5 a4b240cce6e3da6e959f33bd82394034
  • SHA1 ab5d51c7bc80882d9e8f20b11b41a25e775078d6
  • SHA512 f8009e8e7e2735c200057626c4a3c8b4c9c469866b46f8d8e6f2ab8994d317bbbe6b32730b86cf775645851996a79ff2f8d5f12514f5e39bf874cc3851f60bec
  • SSDEEP 24576:hNb6R19IsA8A95bWbiOSc29d8CX5bI7lCIoQIkbRFRHGvustXDF3VBCvxToyTGHS:D8AoW5p0J4DF3LcToyTGSN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  2265cadefense_evasiondiscoveryexecutionamadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3