Extracted

• • Target

    file.exe

  • Size

    423KB

  • MD5

    2a4734d4ba0f0ff0118121dea959ed46

  • SHA1

    7fd8f81b398653938ee4c386ca49edc36b634157

  • SHA256

    ca44f54631582ab59996b46d35711cf8d24f840afb8ad4921904cbe6cd61f36f

  • SHA512

    6143a70a4d0cc9609f4760122c591816fdc63c30f214bc91e90eed89eb50b44ae12c0fe4cb70b19d1277d0f76531502dafa881766e20bbd769c3422a84f1ff6d

  • SSDEEP

    12288:vswXZ6NUIBjPRw3sUZsg4s0cWCxprIrp3:v/6bjPkfKttcWCbrIB

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2