Extracted

• • Target

    file.exe

  • Size

    380KB

  • MD5

    f7fbe9f2c6867d17c2af8f2fe4a70ee2

  • SHA1

    f9d0f31b9425f5565bdadd53dff50702a97f38f8

  • SHA256

    aa29b5fec8025ec05435212828cb2774139156dc891586127a29a893f87f6d73

  • SHA512

    f26796b6e13f55420dc09eb73c51ee05551f290b5f941ce63844bbff877a6b780c1522b63e9041777c3bf45c0a78f89236648805d31124bb7413694b21a88fc0

  • SSDEEP

    3072:0hVqorQEKv5maOpo2EBm2m2rzxeuJ8KCTJY3GnWNTC6NRMHnlXbaeZACHYDrE:gqoKwdQU2Pp56KCTJYWnMW2RqnwDaY

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2