Extracted

• • Target

    file.exe

  • Size

    331KB

  • MD5

    0fa389c8d74861256986a7778b262fdb

  • SHA1

    53f61e274519d7c2cdd4bd8a9364ed159a80a84b

  • SHA256

    74868039bfd6ea947079c1286532c9073d20f319ae0b2d194fe0f081a188cb1e

  • SHA512

    c49513df21e51dbfd530107c7d2c828728b315a8133643c4d503c91931f026e8f7f82b0dae94f557bba0d3e64522f21e6e58644c453de7886d565e14fd4ecbbf

  • SSDEEP

    6144:XMWV77zWzKMaXy5H7C+RdtDVvgimvYNBxCQiN1hWMH6tIDccCMVS:XMWt7K+yp7CG9VviYNBxC1JXDcSVS

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2