Extracted

• • Target
    file.exe
  • Size 367KB
  • SHA256 aef5f37c4670d8a9be061f2f268cce170a024a6a15218849ee3fa2595ebff64e
  • MD5 b2bb96a6c6ff2b875504d83c4ab62547
  • SHA1 b4a120203568c598e47510ded1281cf930a86c13
  • SHA512 9189e5cbc8aae8ab19a125133b456b2a2e60f38d5d5ee82ddb697f5ec1f7686928b01e4556865abf06435532757b838caffa190eccebea26ef5f446937a7156c
  • SSDEEP 6144:0YCh7LAgr3j20Gaq+o8irC1c0zcNue0isvzpQ6ijLxQFiaI:yxkgnDo8id0zcNuexqzpQ6ijqF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2