Extracted

• • Target
    file.exe
  • Size 273KB
  • SHA256 e485011009f74cb1d7916897cd22732446b816632e67f234a7c606fe172da6c4
  • MD5 0e8a123ee38e6298d862b3267a3273b9
  • SHA1 f0eda2f5d2239dcaffa2b67f4a13f5b2f5e409f8
  • SHA512 9d28f47d616e836e95484612e3f538394989176856d5a74b58ae3cc47c5834383566b43f42a7cf28caefbc129e8c7537f78a1b3b23cfce5c1d396cd5ffb55aa3
  • SSDEEP 6144:avLG+7DXlDl/1O9BSfsKG/odDhfgzxp40M2b:avpX5ldO6jdDho
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2