Extracted

• • Target

    file.exe

  • Size

    206KB

  • MD5

    5d3b91499683a2c3e3b9f6580cf3adb9

  • SHA1

    c1c98a7dbe00d80c585574172805f9e52ef62d31

  • SHA256

    0dcfc3b930032d262d92ea5aa282ea1c331e6228f6aebba2b45e54fbe2098cad

  • SHA512

    bc971eeab1cdc7673813eba80ed53ba79435df3bad4bcfb4358f9b2a155a380e2072a23fcd6d7bce9496afe29e6f575d7033517fcddb86e22fd41de50f2496ed

  • SSDEEP

    6144:B635xbr9ecaaYRpugcgRp0Qi+DRj74buFeN:B6H0caZ7DCuFu

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2