Extracted

• • Target

    b42c1bb0721370ef3a905e41c91912b3b46bd2b54915744c2657c6d51ec29419

  • Size

    380KB

  • MD5

    749e95130aba0aab1af11d6f7adcf4a2

  • SHA1

    ae72b9158edb40c2eb6d38531b928931669c62af

  • SHA256

    b42c1bb0721370ef3a905e41c91912b3b46bd2b54915744c2657c6d51ec29419

  • SHA512

    df74624b128480467274f331f2ff26a764d8b992427988e525aa9e4158b9e50983ea3784ec97541276718b1ef1ab6023a9f0b7f1b93f4ad7beded2ca4e83a90e

  • SSDEEP

    6144:4IoAvcvOO39e3j85FQvHc3qyCyDWnMW2Rqnpj5Y:4IoA0GOteCOyqbbMW3LY

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1