Extracted

• • Target
    file.exe
  • Size 380KB
  • SHA256 dea9c08c4923130f955a8a7a20ffc832bbaafc28b414a7a1a6686860e83d98a2
  • MD5 f990042d798722b3990094c81f0acfc9
  • SHA1 680ee4e2f7ef1b5d75219cdf91c75db7c2e6844f
  • SHA512 77a0c64ae6e12c163cb26853d2a550428757a1d82f3781e35f1fb8358a9db7ddc37a2dfeb4d146fc71f46ce2ab6e0a0eca5d64e4db3ce11082e1ecb4b5b3f052
  • SSDEEP 6144:JzOPJKVhoUOCDQo7aBfmwvPN4eUYPO79Dxymlgl9WfaG1PI:JzOPE+URNWOYNdUrVyWgldG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2