Extracted

• • Target
    file.exe
  • Size 379KB
  • SHA256 2d49055fff67f557d2010ac6da454baba1b707e290e9dbd035cfd413ee99a28e
  • MD5 359e6d400866893d416d68d7f8c90392
  • SHA1 dfe03e73d62ef495aefe790dfe76a7d018133274
  • SHA512 4858d33872a8df9dca5e92257d92a71fab6f2e178943cf3479477ffb7013c5febddac09fd7561f628a3b0e547f99a6b1eeac860fe3715ce0cba2465a49a33516
  • SSDEEP 6144:R2o5ylT4Fog26qeE2qlvVLzDY3VxfnMW2RqnmKY:R2o5PFV26qe4zDcMW3mKY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojanpersistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2