Extracted

• • Target

    file.exe

  • Size

    390KB

  • MD5

    9214486c9806c76b57c78d45a96f12a5

  • SHA1

    3714a9b3dc5055859dfc4f17754655f34ac4e140

  • SHA256

    dc0ea03a3427e76cb48c28eb7bf0a57f3518fecf7fa544ae575a549851482555

  • SHA512

    1adac64a2208ea19429d72eae42f8204a9315688f63882763642709938b920395ef0d895253b8e84401db9b0e8c743fcc6df6b3b254cf023a9951f2f13be9342

  • SSDEEP

    6144:4CkxAqAjKJjy2D2ZgWHbaUJxF6UohvnMW2RqnYCi3RrY:4CkmqAj4j3iZgWH2UnF/EMW3YxBrY

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2