Extracted

Extracted

• • Target

    file.exe

  • Size

    273KB

  • MD5

    6a780800f35c265d56eb8baafc6bfd72

  • SHA1

    08725b7773da71bb8f40798bb5b3902ca3dbb9d8

  • SHA256

    7d2fd14c2d3a0429e7dc1dda025e88ab606e0797aa6e6224a8f2f5dc25590d24

  • SHA512

    60d21963686b784718b14ee1df15e745d688b00fb20857c8f2c6a156f1a3ea808f8dec62d5f8c0e5691c6a96961783bff58f24f88e5550991dbbd308b2aac4d3

  • SSDEEP

    6144:Q6f6LwajiXSKmUfECUgBPMTaAl6wPst5G/IQ8qMrc:Q6f67WXSgfxUgBMTywPsbG/V8n

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2