Extracted

• • Target

    file.exe

  • Size

    331KB

  • MD5

    4f574fc271a929d588d132559039a444

  • SHA1

    831e5c9bdb1f02bcd8e99047df194f0c4aecf080

  • SHA256

    03a20a50d7c2d93ef7e22355a1d0244e795d1a0d67d211b6e24451823608e443

  • SHA512

    1415ce833a08ec30d893155556f87fc27748bc73e3b3dfcc7b48244d73fcc2cf0a680ee34ce5938ea05901b32e66e764ea806ca15578d60cd9b24235e11298cb

  • SSDEEP

    6144:kZDnH1LIv8PF2ykp9ubIvYcVhoL+LUNquyIDcidVS:kZDH1EuSvjLADcidVS

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2