Extracted

• • Target

    1dcc23b820b02ad52635b3e5efb1ff8cddc760f9c46c242602123503c0dd989b

  • Size

    415KB

  • MD5

    100117007e6320378e102276f1c9da41

  • SHA1

    839ad2c445b89d78811cf3fe21e3f774057e3dcf

  • SHA256

    1dcc23b820b02ad52635b3e5efb1ff8cddc760f9c46c242602123503c0dd989b

  • SHA512

    1d257883bdfc4e09d3f70e81167793d0f1b6a368ea67ce8afc63fbc9cc65aba51573c8e539a688dee77d7c972b3e5173806ef7fe8e2fd9e159b39d28a1a6381c

  • SSDEEP

    6144:RgV9ZQLsLUoBqHBCpz4zk/LJ6ObdLIfw/al4WcoBlC9ydRaV:RgzZ6s4oBi0pz4zuJpLn0cWC9ydR

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1