Extracted

• • Target

    file.exe

  • Size

    273KB

  • MD5

    67d588981512c4db6508225a1d7b1644

  • SHA1

    baaa04249099b2faede5550e4410a82651f64d46

  • SHA256

    90ef4449f93dcfbec1e10bd8495f39a241cec7e98a4595c4e94dfc0b490dc334

  • SHA512

    fa9e721f52355e5e74aeb363a21dd9f1baac7877488bd724940c607aba8dac621d311edc5db4032cec9a7261e8ef0b55fff6f3ae6511ba1c56f60b82826ccb7b

  • SSDEEP

    6144:329dkLiUR5PW5BRGhSPLETPNCxZWT4x6hng3CDNLU0V6:329i28e5fVPLELzT4whgS54O

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2