Extracted

• • Target

    4ee2520ed9dc5ab83648b0ff057a7b407a1d4ee5667e3b1ecf5fa750d0e7cdf8

  • Size

    233KB

  • MD5

    a11cd81b9c09d6c4e68a2b7d5c6e11b6

  • SHA1

    c4fdfe503e03863a1ecf4f37ff589e99fd9dc81d

  • SHA256

    4ee2520ed9dc5ab83648b0ff057a7b407a1d4ee5667e3b1ecf5fa750d0e7cdf8

  • SHA512

    73d8b8a7b52d7523db845d4fe1e5b76ffa2f86627f4e7487275f23e0e8883e3c0c436250121351d9ee7ebd72b357b0c19310c3b17cbee8f42dd316c2e55eae1c

  • SSDEEP

    3072:BIeViBSPL/ZGlo5kknJ0icNZPE5HQ9SlBzFEIT8HkTlmvNui+ypgVyEIq5o:isj/s4eF1ERQoEITkkwuzUIx5o

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1