Extracted

• • Target

    a0ba61cdc118189e5417f6696c4896e7070e78cd4f4e4599068916cd9084dc65

  • Size

    244KB

  • MD5

    b167de50d4f69ca5132bf2ab8a627451

  • SHA1

    7be661df0a1daea1026e19f278a5e001bda4ff63

  • SHA256

    a0ba61cdc118189e5417f6696c4896e7070e78cd4f4e4599068916cd9084dc65

  • SHA512

    df243f49f9b1c42a6cd7e29eff55d8a28176ecc6e8ee3833da48e8eb35a5fd4ce420e394bc797f16c3172ca4aa88e5ed76ae42bd6d0cb07ffb545c8ba25b4099

  • SSDEEP

    3072:WDA1BBEyyiLknwWXBGo5Uxyfdncbn1DsdBDShaHlx9JWwEApQS:0AuuLknwi88m71GxFtnEE

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  behavioral1behavioral2