Extracted

• • Target

    b683607df14ae608daf23153c5714922fc1ccf1bd2f298ac7647e98eb59cc2cf

  • Size

    244KB

  • MD5

    58588ea18c2dcc2a1b615487e9eef4f0

  • SHA1

    71d0005f925bdd040e73dd8431bd9425b71ab7b4

  • SHA256

    b683607df14ae608daf23153c5714922fc1ccf1bd2f298ac7647e98eb59cc2cf

  • SHA512

    1beee595cd09befcada46c89fb090e74804f11f6ff1c2e8f9fb5c2a9341b06122f7adddb85c19572392d835607edbf69375917ea6ccca22d18c1b868dce29def

  • SSDEEP

    3072:6hMyv8+z1C4MinBr652ai+bXyXsd8li6Sab2QLi3rAX4iqSWoSEJsnE2zRsF2KRh:4Mykj4NnhP+bI4XViqNMKnnzT+Mc

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1