Extracted

• • Target

    dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

  • Size

    780KB

  • MD5

    d53cf9d2e7b6410bec5b8960643cbbc8

  • SHA1

    55afb898ddcb5ef0af47ba7a82d8b820d7496dd6

  • SHA256

    dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

  • SHA512

    d5605e3f6160192b739aad221512307767d38984512f0dd917403daf9111f0d71c3305128fe0e0365cd5f180349146fba02006d646ae8793461459d6e2baa1b2

  • SSDEEP

    12288:M7T+kWJc7161BOrx4l/7B1pVqfjKd1OWUsIOiizzMRK34+NBR:MnVr71OK8Dn2bKLYlizz0K3x

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1