Extracted

• • Target
    file.exe
  • Size 244KB
  • SHA256 4b6e30770bcae7fc6b8dfec2745b54d3abd5dd77c2e3e7cd43a5632fe609a493
  • MD5 0ceb80b9694ad600251fa2f685c6c687
  • SHA1 59e366b9f65224f92918da140b83a8b9fc09b5ab
  • SHA512 f058668060a806ed777d48b019e616d7eaaf8f958c63d787d72394becf5f98b36552cd7a6925973bee6832a482f33c2487f71fc98326588c11833929a1254663
  • SSDEEP 3072:FakzyQ4PYb9o5WQIAg5BAuouW0FZCHaHwMx0K2V3nvfQqNWA0g/SsoN0nG1aZ:FaTpwbURIjnoh0FIHO0tV3XhoGGU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2