Extracted

• • Target

    file.exe

  • Size

    244KB

  • MD5

    02e6fcd8c1d944ba73de12e389ab314e

  • SHA1

    b9969fb9fe35a7d16906ba5cc7d3e457d9cbf24c

  • SHA256

    6fb4b196fcbce9856ff0099ab2108c7a7b0ecce86b133d0eb30f9c2e0010d9c5

  • SHA512

    4eafa4708cd2934186e883f630196dc88c6dc78a2db6bfa3a8628fe9f212297db032458ec7df4a3e3d1e6f6d9c570e55d320bce64beaf3cd1b889700b283836d

  • SSDEEP

    3072:vBkA20emdYBLD/80PW8pD56fpTAe+UyVkMf4DWFsyUf0S1gZICyYp2bkuiWRL:WApwLDE0PPqBTAe3WF/UfTCwbd5

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2