Extracted

• • Target

    file.exe

  • Size

    205KB

  • MD5

    e3cd29457749bbcd912dbc06ff4e96e8

  • SHA1

    10cda0f6139e72854a4c2cdef53e6ee8eccf7b83

  • SHA256

    5f22145a6c9eaf18ed703c43b3b8f03b1db4dab9218e06ecbf3d82ae9f9e4d10

  • SHA512

    5110f1f48c61ec1b188c1a665fe840ab589b660590192e77d0f2c2022eb8acb3766217585fb9f8050d6fc1652752472c78daf60c67f9ae4343b9cd226d6effed

  • SSDEEP

    3072:cpJD+C3LqEQFnHal65mOoZq72/KXxbMvCceciAOnEaa/bJH9DGYKPv/X9HU9bKtN:IT3LqEQVA/Q6+x7cecijH67abWa7

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2