Extracted

• • Target

    file.exe

  • Size

    415KB

  • MD5

    53fe800cca4aa213dd197711d2119374

  • SHA1

    88d55f9d97a489939357c5851caae23198d7e362

  • SHA256

    1132d3d40f22922064a9f284e9a1d6e7fa438aaf64c1ff38859013002adf29be

  • SHA512

    86b7a985c18205d46e00fea8955c7b6e29a5077b17ab89b40c5e570072af977b15677d64551ab02bde7da371f103ffdc557c861afdbcfde28545abc178fbbe78

  • SSDEEP

    6144:DBcAZRfLv46PpYCTszDh6GgBPezRuHanHEH1vGeF1172WcoBlCjdnaV:DBrZNL46RT6DG/H1d11NcWC5n

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2