Extracted

• • Target

    87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe

  • Size

    383KB

  • MD5

    56d9df4afbbaee34afb646e85fb4419d

  • SHA1

    0ad215a57d93b70fa3a137060f5f5a3369d4f542

  • SHA256

    87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c

  • SHA512

    1178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojansuricata

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2