Extracted

• • Target

    1b31d31314be8ef931088d03ac7fff7f3431619d0abadac320e364a8e49de4c5

  • Size

    206KB

  • MD5

    caa2b9781b5aae691347298ecec8e7e7

  • SHA1

    44aeb2cd466d820e23ae91bff755033905b4124c

  • SHA256

    1b31d31314be8ef931088d03ac7fff7f3431619d0abadac320e364a8e49de4c5

  • SHA512

    c82f3d99d1e037cdd67f3972e0b63ad38b46fdc1a3c4e0036f0ca6e9d379f036f1592766192280666e86736eb54eae81e4775bfa862a4d2eb72c7220a00b122a

  • SSDEEP

    3072:W4aBeDQyO0mB52OXrKRIR5kZqa8+kfBexT9vuEjX4qAWYj5VZCs6plryJAmF:eLB0J6zajkfB8xG8otWYjbos6j/m

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1