Extracted

• • Target

    file.exe

  • Size

    206KB

  • MD5

    2c7366e9e9fd9d121b26c286369d6a6d

  • SHA1

    85623beeaa7cd26d569632b449fdafb912c07248

  • SHA256

    2a1cee476f33a8e2dacc5a300e8d1d700f4f237b5444567289274990d122f629

  • SHA512

    e2e37a82b72c5441a3dd704bd1f40487f2a0df22640b604d9d51c2b4403ae175ab124f874a3f52d19452df83939ad6cc11d7be1a79f5043fec33bce61b37dd93

  • SSDEEP

    3072:7ZfKw2EUAAnE5Jm6fjGWurX4Ddj2VmpQF0ZjjWVyv+m6NFKum/wEEouoF7FaYxTM:Nm0AOrurX+UZOHK8+mOlBoZF7FhxQ

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2