Extracted

• • Target
    file.exe
  • Size 222KB
  • SHA256 9073d5f57b251a201ec80f97db564d148ecc69d736c43ef89208adff6d5a6766
  • MD5 519c6bb6a935816ec7a843bee89fb5e0
  • SHA1 86005dce6e0da9aac1c43fcc443ee671e8cc34d2
  • SHA512 9ff3a29a3af538873a1bfb340502233e068a02fe0649899d9c8b8357d35bc47197a0fcbd79ddf94ac21ebcdcc4ccb79b5b13f8b5986a8f6898564103a2db2021
  • SSDEEP 6144:QWH8o0RyvU47sqz2EFyW05AiR2vZ73UdgXzff:Qe8dyc+sqz2EQWIA8s3Udw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2