Download bundle index for the Amadey 5.78 cred64.dll plugin write-up.

Primary public artefact repository:

• taogoldi/analysis_data/amadey_cred64_may_2026

Direct folders:

• scripts/ decoder.py (Vigenère + Base64 reproduction), ida_rename_amadey.py (idempotent IDApython annotation pass)
• detection/ seven YARA rules (also mirrored at YARA/stealers/amadey/)
• reports/json/ decoded strings table and structured static + cross-reference + C2-probe report
• images/ Mermaid sources, rendered diagrams (kill chain, decode pipeline), IDA screenshots
• docs/ blog source markdown
• c2_probe/ panel artefacts captured during the live C2 probe

Key external references:

• Tria.ge sandbox report 260426-nq42gsaw9r
• MalwareBazaar entry
• VirusTotal community page
• 0x0d4y: Amadey targeted analysis
• Morado: Amadey Loader Analysis
• VMRay: Amadey new encoding with old tricks

The bot binary itself (cred64.dll, cred.dll) is not redistributed in this bundle. Analysts who want the raw samples can pull them from the upstream sources above.