Extracted

• • Target

    file.exe

  • Size

    246KB

  • MD5

    087d57b3216e7de1b986bfa203ae7a7f

  • SHA1

    bac884f89a63a069b6ae9a3c88e561ff4ae95c28

  • SHA256

    720c85c9b4f5c1bc9bcbc99e36f93f78657c2737fa9119df2c57e5dacec719a0

  • SHA512

    4dedbc487ed622af05cde9d2683d010fdd62038689af5cae4d4b3347cf1081a142acddb2b3d016c31b7f84064e9db2222d418085a32d7f7121a3149fada3ddd4

  • SSDEEP

    6144:hyBb/btE2gCmI70JrDif4TijwX9KCj/wm2LSNdHy1lJBN:hyBb/bDgDMvwHz/QAdS1/f

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2