Extracted

• • Target

    file.exe

  • Size

    274KB

  • MD5

    735d9f6198657375a7bc2924424f454a

  • SHA1

    88dafd8b7050af691606c0e726a4905481e47b0a

  • SHA256

    ee4f8b57a8079b8446a1effa1607fad6101db23fe0babc908085c49838e25e5b

  • SHA512

    2c67b09152c104f2bf0b5167ed9fdeef683f4cd976d12a2d68c958843046acc65c428d39a17b3348891e935bfb37e618c6118e84eb0ba012331f2215c7e7f816

  • SSDEEP

    6144:LELQeA6ZLi+zGBpcCssz+BPLZ7agztKYA40M2b:LE3z++upcZsz+BDRpKY

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2