Extracted

• • Target

    441e2f26fb49f9e163d634b5726e559ad2b8a2b33410a11aea7b12bcbd9eec09

  • Size

    248KB

  • MD5

    12e5d04bd1499ce6479769d28412cae2

  • SHA1

    0b6b734c8485840765563cf4f986bcb63c71cb7e

  • SHA256

    441e2f26fb49f9e163d634b5726e559ad2b8a2b33410a11aea7b12bcbd9eec09

  • SHA512

    d420eba6e6c6f05f739b4684caca43049fb5f5dd835f9d18190dfb3c8f38a00de3681a42b01918e6e3f638d82ecc445e970143fdbd905d37e297e939605f92ab

  • SSDEEP

    6144:r9cLYyFDnA2y1w1Tel+z5y5PxpwgJCoG/rBc:r9ckcDA3SaE1EIoG/u

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1