Extracted

• • Target

    465ac9ba486e2af14f1ffb5d355def27939586678a985966dd2bb8e2c38d3d91

  • Size

    380KB

  • MD5

    6b8a64eb90ea22a4e5510151227f986d

  • SHA1

    aa8414536ef9a534e7df8d12e9fbab1c42a31dcd

  • SHA256

    465ac9ba486e2af14f1ffb5d355def27939586678a985966dd2bb8e2c38d3d91

  • SHA512

    b2adbe3e2f2ccf95385bf87be5bb86801cbcad9edab4440e69a95a35c53011f5c92cff771bf59ee7fabe97784a36e858341ab1eb8ef24378afdd1e66a2105627

  • SSDEEP

    6144:+PmBsi6f66xq++3tgc9S84GRxzgxZymlglUbz7G1P0y:+uBsi6Fx7+3ZM8pxzgxZyWglUPG

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1