Extracted

• • Target

    bb898fc8ef6cff018decd4ae76d5ac229f0a2f5c0cfd4bfeae7fb12e2258ca25

  • Size

    389KB

  • MD5

    f796336113826df04fbf0845855afb69

  • SHA1

    3d470adad56dd662c998dccb5dd487cf532d3b63

  • SHA256

    bb898fc8ef6cff018decd4ae76d5ac229f0a2f5c0cfd4bfeae7fb12e2258ca25

  • SHA512

    a8ce87e31acee87beba5285d2af8cd1821b6dc4ce22fdf81b727960edeba68a5eabc62e41f517f61c39b3a7c63d384dc35a11bcffec0f037410d02457ff401bc

  • SSDEEP

    6144:udwIjxLZ8uqEcRMzlLB7iBPJ5G9f5CHKpf+QuR7jYkj8:ue6x9qEjNB2nsf5j+dRn/

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1