Extracted

• • Target

    file.exe

  • Size

    415KB

  • MD5

    4e12f53b36ae58a9e181cd3bc660e750

  • SHA1

    d8643ea88ebc7a3c249f67d960bcbdd8f0256f62

  • SHA256

    c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

  • SHA512

    3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16

  • SSDEEP

    6144:/mjIyZwfLm4RP6BLMZhJrAHo496ZC4qVatxX4WcoBlCwh/yaV:/mjBZWi4RCBQ8oFQ3VatxrcWCsq

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2