Extracted

• • Target
    file.exe
  • Size 421KB
  • SHA256 51d878f00166f0fa41b1d26d3f1f386aae3697fd35bf1a798aecb442eca437c5
  • MD5 95c94ebd6b69847c3fa598163f499c78
  • SHA1 b3f2b849bb2f9ddbd3551e60973c3fe8f228516e
  • SHA512 68814791e8e0091a3d0465144aadbb6b69728b6c293e8237760a13055ed46f9f5fb6978de713a671b84240b66fc0d18abe7c0d78228ac5f735ca997775c05c5a
  • SSDEEP 6144:4XpGLNufxsoxVK3o5aw03th0c2EM9X4bhh6K9W9TnWded89kTR:4MJufqkK45Idu7EM9XCIK9W9Daw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2