Extracted

• • Target
    file.exe
  • Size 273KB
  • SHA256 09a779cf89b0271a88112d4bbb2c5605816c1934ea0ced097643d13ac95888a6
  • MD5 41bbc8b97453e0412c1bb0dc0d02730d
  • SHA1 e16bff301a4b768ff00b029d851e1091a8e7cc5b
  • SHA512 e9e31c34c40ef7be3f1afc574bcb48995f96f8eeaabf03fcf44e625323217b07bd2075ecb9f5d30a9688724ab5d448a1f7d3c58cabb68336f0d5033463b75e7f
  • SSDEEP 6144:6ILH9nRvBkZDRCG52J/dwmt3tRJD8qMrc:6IxnR5AW3HR8n
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionspywarestealertrojanpersistence

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2