Extracted

• • Target

    d8eaf76f6b75f4b4b7a38712ad9a4174.exe

  • Size

    232KB

  • MD5

    d8eaf76f6b75f4b4b7a38712ad9a4174

  • SHA1

    aa74ec9a6f5c543b5464359a6244d14048d83405

  • SHA256

    48c1869ef95bc7164e5e185ea4c4124ee90d7bddbb6326b37718dc59a84042b1

  • SHA512

    880abb93dcb9df0a6e23b6c8f78e1848f3ad94ff0fb592eaba57ebf53d0f238a12af272c9eaa5c0c57a6d0b5960317ada63b95d3a00d41154b1f872a4f2220f5

  • SSDEEP

    3072:jR/lxNqg0bujxHo5+KaAcLfbFHc6d17vFdf70pb4nIFr2cTjno8JiXTkt7H:9syN/Hld17vFdf7Isq2gjo4iGH

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2