Extracted

• • Target

    72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

  • Size

    243KB

  • MD5

    40b6b1e680f2b6956f41a4c87c393f92

  • SHA1

    4368556425ee592e1692db8fbaf69e392daf50bf

  • SHA256

    72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

  • SHA512

    b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270

  • SSDEEP

    3072:12wN0+6hseC5rPFRlKCNl6+J9HXWXIkLgsoC1kZi6Te4Mp4KHidIGa3sYDAbEaDt:WhseWi8J9SIkkso3v98CdIoEa

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1