Extracted

• • Target
    file.exe
  • Size 322KB
  • SHA256 be42aa1ebca934882b95a2ff7656568000df0cc537710011e5316265da67ca31
  • MD5 0808cc3004a72880dd2b8a8976fe47aa
  • SHA1 38b6c1db3e725da3d38f01f29674763504c3c68c
  • SHA512 1483336f06ed52643d56d89ba4ece8da7c5d9ac55151a2febef97c99428f4e4b93ee44283214ab7aaa92de3492166a07dc06fa7f3447a1e82beee99a082ea727
  • SSDEEP 3072:8yr85bLPdeoabsN9H5W2o03ehvJ7iCEXzaOlVEaG9C3xvH9PUEAx6M9BeV6mkxVP:8D8s/omSR7k5aaa8Nc6M6BkfLEilf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2