Extracted

• • Target

    c8a47f40b677fe913a3bc2c13ab9252790f2ca7492e25a55f553bc62a9f6712c

  • Size

    227KB

  • MD5

    114b5b705fdfe9aab9c96c95a486e862

  • SHA1

    cc1484deb9151c9947da10d8828b87bc45d078b8

  • SHA256

    c8a47f40b677fe913a3bc2c13ab9252790f2ca7492e25a55f553bc62a9f6712c

  • SHA512

    59373d9952a144679c6b37cc9cdfbe67d1a2623e791d84c8ae3b3ec18be9259d7e1d1c61ecab87933756965bcbceb7f22c27915ff1d3399225ea54295aa20bcd

  • SSDEEP

    3072:kcHEpYUaUKMUK6Vu5xqT+3IvtrVdg815dL9ZwJ5UeCwL6EX/pG7ZrDjh8nRn081x:krrKMUK6z+3IdVy814JxL/BAp2Rn0O5

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1