Extracted

• • Target

    b656d2dfb1646d77a60799c56814a7d6.exe

  • Size

    247KB

  • MD5

    b656d2dfb1646d77a60799c56814a7d6

  • SHA1

    1364be44ee074ffbec0b0c992a917920c580f948

  • SHA256

    54eac531f0ca8495f2c3ddbb73e29280200a6635c0b35ca094e65b48a6cffe64

  • SHA512

    c3d72adbccd49f3dc3c32a2c2dd281acfcf1af68fdcc4f3ed4920d64d6250ea0f001e5ba64f1c776d483b109d20c6ab1ffa8f8ac64ef335433cd03b922ecbdc1

  • SSDEEP

    3072:zg3sOgVS6iOK7LaeaAVHKi5WxSCxkOWMpSmIPkfcl0oS+yzCvSgBX3XQsPR:E3LbLaeaWQxmqp7KkfcLSNCvSU3X9J

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2