Extracted

• • Target
    file.exe
  • Size 244KB
  • SHA256 f90007141d679ae7d1bbff3419f0ae429cd2a3b621d3aa0c4e5472a0cd8f2d41
  • MD5 3abe18eeaa890d7b3853190d4cadb78b
  • SHA1 df347d6760b2776e3c01af0a42034ed946bb696c
  • SHA512 f750e9138e9d021a306a52855008764ddf3e8f8a43c5547e65f26000b94a1d7f57c3ce6772e35c2e287ccd8fe79ff8fbeb21eb093a699e4c71bb90c08a9d66b9
  • SSDEEP 3072:tsjGN+YqLpWLUfY5XYiX5PzxWY33cGDWIXpA6C5fhGVRlyn8eT0PMPnrlaFVjMvF:tsmApOUu5Pnckxw5uyn8eTC8laFF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2