Extracted

• • Target

    file.exe

  • Size

    415KB

  • MD5

    bb0df5d5985091ef9a308d0d78fc0a0a

  • SHA1

    3c1b7b27748aada2899cc9320d00820d562ad57f

  • SHA256

    4df604772c5244204b6450edf0a885698ee1f46e832d234542a0a79a6293d55c

  • SHA512

    54bdb7c944677c065ec95b90e5bf10df37a68b7f0b4096e6f8ee9343397706808c7378691f2e77d7d95bdec4503dee24c4cc84c68c1ecc2e799fe547bd1393c8

  • SSDEEP

    6144:WjWUZQjLKPEZ3p/GHPVyUhODasKoxOtUG84WcoBlCEnaV:WjhZi+PEppGHPV3hQasKoUmcWCEn

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2