Extracted

• • Target

    file

  • Size

    244KB

  • MD5

    348cae91de56dc1c3e6fd6092d217cfa

  • SHA1

    80fa44cb1ec02fda90a69ee4ba5bcdecfee3c897

  • SHA256

    97cbe111f5800fb4c946dfedfdf8dd60fe95bd7f5f84c378dfd815164776024a

  • SHA512

    f393a740999b75ffd997cac5a12ce8aad4c64fa60fd3c04a4dd639c41403c5a602e750c02d0e88a39ef3e1b130ef2ff4e8a9605250a358c26f02b2db1edc94de

  • SSDEEP

    3072:SAtdssD4RycKL8SCAaIB5S+S53NrotkEJ7Ng3eyLyGABdW/hDDjW9o/oYtJOmf:rdcKL8SCjt+S5lo3ONLmOEovPO

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2