Extracted

• • Target

    72c59b064cba88f8abb3995ff1c623fe5314d6957b4272d32b2b6f1b85e74525.exe

  • Size

    367KB

  • MD5

    a9809d7851483b4361b6f1bd85bd9d65

  • SHA1

    6b5276635d49e6c96aaaf44c02fa805424f3d4c9

  • SHA256

    72c59b064cba88f8abb3995ff1c623fe5314d6957b4272d32b2b6f1b85e74525

  • SHA512

    8eb3fe8f7d33da49109617dec513c2eb445fb24ee66f9eae243b56a05d9468045b1fe39572ad386fafcede08d80394c506316d75840c4e2f2c805d61671d6d7f

  • SSDEEP

    6144:rYEMnLAagdTvg1/TfKhYA0JMoFlWQwM0isvzpQ6ijLxQFiaI+:lGsagds1/iJuPwMxqzpQ6ijqF

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2