Extracted

• • Target

    009adc2d6239a57f51e0e6add913c5c050817274ee9becafd713e8ce243d34c1

  • Size

    220KB

  • MD5

    ea28c15e9af2a55f313039ed3110b691

  • SHA1

    19fc1b7b60964e3c7033b1e94b5f3adea7cc989e

  • SHA256

    009adc2d6239a57f51e0e6add913c5c050817274ee9becafd713e8ce243d34c1

  • SHA512

    145d4756147f2dcf471a04b12987117e17f1a54b6b1f24ad447f6182886c4d87b5fe65b4f7aa95c1a6aa169b39810230dfee404d4d302ca0d6fcb9269e56269e

  • SSDEEP

    3072:e1jMJDdlipHtrpd54QTSdUkqVYxQnQ2Dv/Ym2ZVL6Y4+Sv8ngNGNwtrxZfFSBZ1Z:cKDdItd+XqVYegy5+yb9Kvp7cd

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2