Extracted

• • Target
    file.exe
  • Size 389KB
  • SHA256 8ed223a60faad53e4c22eb17e2bf485262e3758fc0543b589ee65fe736c9eaab
  • MD5 df1e365d58ca7859bd2df4e0a3d59345
  • SHA1 733ee27d95def31827d378a62cdbed153b52dad2
  • SHA512 c354ae283175825afc6717f37c8e441348c3cba4b183fabdca1cf79d60a91db458c41aa6cfc767a3be7ee6458d6744974f591e683ef24c48e444875822f1623f
  • SSDEEP 6144:cGOIjxLN8u5EcR6kW41BmHsEyd6l5tYGnq9juR1iejH:cH6xx5EwW41BmXyd6lG9iRn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2