Extracted

• • Target

    9bfc109195c0748916ef828420c3650e2c9644c4d39fd18c2d69bd36fa42ebba.exe

  • Size

    390KB

  • MD5

    339aaf5da09bf00d3ead836d98be1e32

  • SHA1

    b501fd44f4e5ecb769c292ac3f31b079defb4890

  • SHA256

    9bfc109195c0748916ef828420c3650e2c9644c4d39fd18c2d69bd36fa42ebba

  • SHA512

    87090a8bf34b28e2dad14936de0421f226dcc37ae8baec23635307a397f7f7463e217f7cede480f3e71dde384522bae22596f7749ba85ea9306a9386c291b805

  • SSDEEP

    6144:g05zgPbAreZ0xRq4mudXX1vgr5m3dgnMW2RqnL7Y:g05z6Ar60xRq3a1vgdogMW3L7Y

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2