Extracted

• • Target
    file.exe
  • Size 421KB
  • SHA256 1f142c5834288f15e8d6ec3fd125bcd17cc8d58097e5949f1f8a618ae08fcfc6
  • MD5 54937a7a6cccaedd798a60b888d2c7db
  • SHA1 f6acbc84d0cc476eb1043f0dde928415b43f6a43
  • SHA512 baea8a38cc36fc03da9a6d77a9329c8d5ed7b4245cc1bb4fcbc14fc423eebe92bec675fdc39507e97f586762878a6aa3540728a6c479b0c74b5900f74999f759
  • SSDEEP 6144:DIuULIuowfcncOkEIsDO43xcbafNTyqWcoBlCWmeoM4aVe:DYkuBfchkEHDTcbUycWCWB143
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2