Extracted

• • Target
    file.exe
  • Size 420KB
  • SHA256 cec4b37360c07b3c189708d0feaae094ecb2f3e3d10bdbca93273e3a965f16ab
  • MD5 a6a58a7daa02c1c2075848e47e66bc2d
  • SHA1 bb8a565f5e635cfb899a6c5f3aeb096a2fa96185
  • SHA512 2fe6974fe14c2b221e7dba8360a6d922569e659eeb82d3f33a49d92a786473068fac74b68a303e0fe17e066d635c6b845afc138d5f76bdf7de5669ba239715de
  • SSDEEP 6144:zrJILqAs0H92SF9eKlFFo7vnD3caIz3qWcoBlCa4eaVe:zueAs0HMfgFK7vnD3cjZcWC7e3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2