Extracted

• • Target

    file.exe

  • Size

    209KB

  • MD5

    62d3422fbe459404d4e605d2d82b8d75

  • SHA1

    9b128a5874f501f092a6dbc53b9ad165f4c8998f

  • SHA256

    efc8bc169164f8aa2758a7bda04f017e08552a51490594a828cf1fa3267f09d5

  • SHA512

    6a94d84f3a3d7b084e8f394c8c6fef36548987ee710ac721b57ffb0567d236c049471655d8c77c82da6d796ab8be174424b60856218f94d4b3bf629914cccc58

  • SSDEEP

    6144:45eKJsCOgjDDcAh2OY0keRQTHwh30XJ6ymr:weKJOmr36THcEXsyW

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2