Extracted

• • Target

    b4ba5419be79e50032ce8b3a3a76306de1988d886cc23f24fac80d921d2a1c91

  • Size

    209KB

  • MD5

    cc7275c89f040e985f143cc9812209e3

  • SHA1

    0f6b112fca187c82b2d6189d9418485f8096b599

  • SHA256

    b4ba5419be79e50032ce8b3a3a76306de1988d886cc23f24fac80d921d2a1c91

  • SHA512

    489cb8edef9ca25477c6bc67e8d47696b099ae33eaa37e06b5eefcc8e248ff4434614da0b5b23ed87c94c10252cdb773981026b7d81a04e3912b26fb57ea54df

  • SSDEEP

    3072:FSJCYwq/9oSwYSOdW5zfLDNgWa27umF2SSr/QOtsVIR4iqQfq0sPtNxUot:8Ck/3SOuDNgUuDvDQOhlsPtvU

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1