Extracted

• • Target
    file.exe
  • Size 410KB
  • SHA256 328678b277b9733b1eaa662113a67cd61e04e96f4644b8623aadbd5b9e6b86cf
  • MD5 6fdebc9ff81d0068e8f7f57a41a42ebc
  • SHA1 33b44f4844e7ef23d9a41301e92bbc55ac6a0397
  • SHA512 6b30f54c66429032233bae2be8480114161909c9db6977fdc5cd4577410a0164405ecae77694eb9eb1e5922575425168fcc51dfa510fcdb553a88aef4801d745
  • SSDEEP 6144:rO9puA1ooCPY9v2PlyKa12sOp2Nwcf8ymlgl5qWG1PI:rO9IA+oCzPlbTsW22c0yWgloWG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojanpersistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2