Extracted

• • Target
    file.exe
  • Size 221KB
  • SHA256 6c4be2565f574c211f5fb88e47e703ff9b254bf6fcc2fd8fde7bd00ea3e38600
  • MD5 05db44047f62012ffc23c3e9c86e02bc
  • SHA1 612dc2bffee83223970be8b5f75f98ff9f6931e2
  • SHA512 4dbb6c3efc268b6854567ce173448105a8ddaacb320a63f9f77c14e7c77f50c528a6d51f0bebf6a53cacc27f57dc90385d4e023bb92d6ba8c8f6d3fec9dff670
  • SSDEEP 3072:2P3nuYbDV0Qz85DQx/DvJI+IwRV3tA/6fMgBlZd6in9D7xvfd3xAn9sk:2vuYbSQyq9wSzFfMOJ6inZ7xvEna
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2