Extracted

• • Target
    2026-06-25_03c34c25f4b3d2532d4febd924dc747e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
  • Size 198KB
  • SHA256 8ead046c02c7280fcfabba4cb7d276228dfbf690d344ae4f82047a90716db1aa
  • MD5 03c34c25f4b3d2532d4febd924dc747e
  • SHA1 d559f97f388e410044a343bbf0257c234a73aa36
  • SHA512 3401dc9e2219edc8bdc83a41dd99187da49065132cc78843ffa1468826e648dd26208e2f0fac091aee8e7887de64f45b1ffe7a144b1ba0a26356827a179d6cf2
  • SSDEEP 3072:n1/1YR38E0YD0ixsstk7bRs4GxbVr9r+zHG/2zZNuAKq3mUhUwHMNfAlWXc4Emi:n19Ys/ixsNHK4GxV192/uAKq/sAlec
  • TLSH
    T1F1143A617852C072D664657219F4BFF2C5ADA814ABB049EF2B800F77DA212F37931E39
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionamadeypersistenceprivilege_escalationtrojan

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1