Extracted

• • Target
    file.exe
  • Size 422KB
  • SHA256 927dab0e547bac8286ec7466ed3e6d13dccf154d2cfa94f731eb6d2838704f79
  • MD5 bd17374bc65b8b31881637d99455c071
  • SHA1 9f402ea43e3cf359071df9f168b55b73f2152f53
  • SHA512 a51fafb0b4cbf9f910ac59c578a783fa4c48de3929fa21d43c89dffb553054b70d4ca48f83361707b9f9440aa409239038325c95f01ac613b41590b7304dfed7
  • SSDEEP 12288:H26QSPBUg7SAXfkSY6u77jgcwTMSFnPs:HtXPBz7bfkSY6u7vwTMyn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2