Extracted

• • Target

    e17ae6dc6b124cbcb453e0e5bd5319d8cb9dc4df70972b50d91e49cccc7d2f7f.exe

  • Size

    218KB

  • MD5

    2e5816315adcf88c8a527722a6590ed6

  • SHA1

    e6756efbc30a0af6d55a64f0a3fefe3cea45293a

  • SHA256

    e17ae6dc6b124cbcb453e0e5bd5319d8cb9dc4df70972b50d91e49cccc7d2f7f

  • SHA512

    1d593ef730be2e5b094ba84f7ce5d86abeffa89a81f28c90d4740926018233d8e7cfc9e86046d60ae9594f8f61e28e6bf0f3712cfe33ac348289238ad5cd9756

  Score

  10^/10

  amadeycollectionspywarestealersuricatatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2