Extracted

• • Target

    file.exe

  • Size

    379KB

  • MD5

    014c9f06c7d3f045553c0f4cd437e333

  • SHA1

    b53d5485aa74e39e5c9f67b4a6d337907b6d16af

  • SHA256

    1f2ef0df377063c9bded2935fe6f3d767a58b53673d5698ac5bdd5cd5acbb5d0

  • SHA512

    c7716ccf741ee1d63e1a300002c74d8463f7e53e84b78ff6afebf268ad88419b50817eb77c7bb539ecd9da2e6757ea566509bf4c388fd8833936305d1cb05f2b

  • SSDEEP

    6144:1Ov+o+SqTCNQlBhCAm8YAtr7NEnMW2Rqn9l1yyY:1Ov+o+5TCNCBMANtwMW39lBY

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2