Extracted

• • Target
    file.exe
  • Size 244KB
  • SHA256 db2653ed3a2c4dce389b0498c7b43b20c18bff72630d4bcf9b79f29257349892
  • MD5 42ee511c7c5970c3244699264fd3b18a
  • SHA1 dbf46acca19c424ab5dd65612f9b943781cc8b3e
  • SHA512 495cdbc66435a27ed1b35437f89781bea6d4907a21256f581f16e926c548f2b0eb5210a842db8870fdfaf8a8eb52a4d81351d2fe1db0244730c9ac0209fa9798
  • SSDEEP 3072:fi7qH+MuCy++iJC5zVXgZ6kGFQWrMMZ6O0Y10CVKRYEkS7CEGfVaAMYkqsQjgRui:MCy++iIVT/Mi03RYtonYkqsQgRbEath
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2