Extracted

Extracted

• • Target

    8fbe5f67479fc7a6532536299c765c41286c9b5347a8b6eded059d35dc218966

  • Size

    209KB

  • MD5

    9a557c8759ef2110b4fb56daf43a9376

  • SHA1

    178ec11e910999d49f0c51e47ae25c3f60f327e2

  • SHA256

    8fbe5f67479fc7a6532536299c765c41286c9b5347a8b6eded059d35dc218966

  • SHA512

    ecf57244634a298de0fecf9765ef15d344ddd87d203e2df742d4cbed0e48c4a9d238b0be7e7ed8d9061a8822706846d7d29029e93fabfd604866bfbbf4f4643a

  • SSDEEP

    6144:VLwQ3tESz48VdfPSqnk7e7d/+qvedJe8:VX2SzFVdf6qkkd/zmbe

  Score

  10^/10

  amadeylaplascollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Laplas Clipper

    Laplas is a crypto wallet stealer with two variants written in Golang and C#.

    stealerlaplas

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1