Extracted

• • Target
    file.exe
  • Size 341KB
  • SHA256 8b9bcaad4a244df4b93caffa11155241455f1d5c763aacc02e8a008a32acde7b
  • MD5 62db020c36a103b43032de57ca26ae7b
  • SHA1 f33c5441f04a0589f542efed2b03b5ec6a7e4748
  • SHA512 6a132c07a4aa5b9584e05ebc568ad2f1ead3744ce4810ec89f53619a1b84bdb9b97a44d0bafac52d730d2bed7028209cb76b4f93d97a5d26931ab02a3a71d340
  • SSDEEP 6144:PYzbvEpwL3R8CkebQUKUyMrzWdWk3/sMDmshnkf8+CwbG:AzbvEp2B3keEzHMrydW/6zc8wG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2