Extracted

• • Target

    file.exe

  • Size

    375KB

  • MD5

    c59d562b2194051053f981cc986e2c26

  • SHA1

    7294a69b761ea21921cc8a17e641eb5900eae096

  • SHA256

    81bd4744776f8144797a834c7f90a49b7b89895ab3b899b53966c0062e446489

  • SHA512

    678ad14c3b9673d28c334d088b74bb07a966a37904c2ddebe56194115088d68de06a506c5ac213a297db28010b579820af1f985798f3239eb3ebd0ef04e154ba

  • SSDEEP

    6144:rjTwNWqX/1Z5cqCOysofQnMW2RqnnA5Y:rjTwWqX/1Z5iVWMW32Y

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2