Extracted

• • Target

    file.exe

  • Size

    209KB

  • MD5

    bebede721760bb01fec9a831b1a81ff1

  • SHA1

    4f8204edd4d53d878e9a47ec36f4d4be1962903b

  • SHA256

    e6dfff250936d9cfeac0a71fd1147d4b290e078ea382e52dba09516f35a1dc68

  • SHA512

    7e595d29ad8ef52aafba9cc162d2a042b70f81819242f01047c15e2bd430e1119b5a793119834a759f41720b0ee480a8d27b37e5100e4a098b5eab4b37d916c7

  • SSDEEP

    3072:Bp4WwqNbH3iGA+0OXW51o3/aDgMg+UmdhN5GFA/q6Ww0AitabmjjPf:w+9F0OUo3qg+DNAFAdj0RIy

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2