Extracted

• • Target
    file.exe
  • Size 410KB
  • SHA256 a17b1b48e85e6f8713723bb4417ecfc2deb0741a1a9a33f5c54b286d7e4de5f5
  • MD5 8685934a676f759ca71aaf2fa84d22f6
  • SHA1 4e932132df790427dd443426cc9b8716106ef03e
  • SHA512 57c78d982dd99f45a0bce3956d6ee2d32aa5e2e0afb5a521f4caca583fef70967afe662fac8ca5b4773e8fe479297d213bdd9855611d9bccd2c47681b7c5a95e
  • SSDEEP 12288:vOZmeALuKmhhhhHtYzXdHYjvLyWglW8dG:vG4LuKmhhhhKHYjvL+7G
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2