Extracted

• • Target
    file.exe
  • Size 322KB
  • SHA256 9a75f61fd577a3545e4c5abdfa1aca0bd122df23c75351e1572940bcf8a7505e
  • MD5 dd5e18def7b29c1503d1bc5e4bc65675
  • SHA1 1c3497bad1e9881e0bcbba62104a71a968b9c04b
  • SHA512 cc78b256caac443facad522277dcbf85b79a6424278a2b3f8851d35856c2a5bff773710c9666651f61c3e66bf2aca05b718bb68b8123ba27159e22c5b7a1ca32
  • SSDEEP 6144:o4usZMBLJoMvPazR81pbR1v+BzgyVilf:o4usZsLJbPazeN1vAcl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2