Extracted

• • Target
    file.exe
  • Size 351KB
  • SHA256 fbcd823b376cfb88ab9f8a9740b82a5dbe6c694386c8a66484e4110c82b2b527
  • MD5 1d928af58e1dd5dced78cc48633c95eb
  • SHA1 a24642bca2b3f167b09aeb84edaf3a1f3a2031ab
  • SHA512 495493642a4da6b095d4618a3a96a109f8edddb9e00abee752537d89947e89cdd96cb1696de306f09c4036f427164e58696a700888d9af8b8c57baf5670d9468
  • SSDEEP 6144:aomxi1fOSn1FbR0isrfX1/cCcok8sMDmshnkf8+CwbG:BIi1f7TSpB/hcokF6zc8wG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojanpersistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2