Extracted

• • Target

    52ab17e6baae53d7a40550a25026254632489408293f88189bba8e39d6b28aed

  • Size

    203KB

  • MD5

    d6a9dd3aee97b972e6e7dbddf3c0a56e

  • SHA1

    f60044d11436459f732dab4998911af5c2d6e806

  • SHA256

    52ab17e6baae53d7a40550a25026254632489408293f88189bba8e39d6b28aed

  • SHA512

    605fb353f97b23afe53305a799ae93c8d18b7c583a6ff8cc48b436510ba7e3298d086c362d5bbdb1739431ae3515876cd0ca5c849808e9bbaee4ea6edafe4172

  • SSDEEP

    3072:lVkZ9BXXQI8I+5kbKILqwFxa7vaZJ3AcpwVvnGpjaDU4cT7ynsv:291QI8QXDFhJyJyIcTk

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1