Extracted

• • Target

    file.exe

  • Size

    244KB

  • MD5

    3d4d71659223d86d57219cd8152480ae

  • SHA1

    24de5f6756bf2d98758331c18e575859a9544e14

  • SHA256

    7a46342a19c0ed594723f85466a6ce0a884b1cb9fcbfc75bad6fbc4d415eff46

  • SHA512

    c6ccdc1c99ed72c0d8ca46399de7801618dba95a1e1e43cbd515c338d1ddb8fd29c08b65186f85ec70ee19ff3a60aa16d2b6888024a87eedb7f797284c7310d7

  • SSDEEP

    3072:PAOXJhW52kchLM4G4SZk53OB03dU/dPp7WhIOg2IXAszVKGzpvEMEd5vr05tfmNO:bX1hLM4GbsRAMzOzV5CMH/kBoek

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2