Extracted

• • Target

    77e72716e7777860a6c96433b6c1b18405bd0d7bf4e568a607b6ffab757c9959

  • Size

    206KB

  • MD5

    b6df1f26caece2b7930761f8b46e11fe

  • SHA1

    f2cebea125286af6fde50c4223c369be3fff9430

  • SHA256

    77e72716e7777860a6c96433b6c1b18405bd0d7bf4e568a607b6ffab757c9959

  • SHA512

    aa0f1aa56270329f8ef4b7d5a5c176734131e2921c31ce320b961b1af596b343c9608cad68476b61773a070b01ce3db079e1e95aed4a8c3f7206d1f3f1606e2a

  • SSDEEP

    6144:yo8a9qbNSBLp3a1W2q0fK4QDWwjIF5Py:yS9eNSzam0fK4wjIv6

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1