Extracted

• • Target

    11a7901865f72824a7e3e25dea20f4f0be735deaa55fb67b3c526277e1f391be

  • Size

    209KB

  • MD5

    b560f88c657d22b44188c64dcfe2bd84

  • SHA1

    cb717b57a47a701881ce39e2f7ec5a7488183158

  • SHA256

    11a7901865f72824a7e3e25dea20f4f0be735deaa55fb67b3c526277e1f391be

  • SHA512

    57b55fa78014d6626a67974336613aae2d8aa4340dcfa123ef5b34ba82baae404f8aa70683d5538a87566073d780eac4a24364c5e7b8316ae85a202d4cc0e90c

  • SSDEEP

    6144:9WL2/h/gphpstUBwWrkFFLaYTuizLTTa:9bcstI+aYTuiPa

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1