Extracted

• • Target
    file.exe
  • Size 273KB
  • SHA256 945b721fead53302f3a5b90d2aea24b7964aa3eff35785f202305bcb378e7ab7
  • MD5 da426e3443a12463e64809a7f3cbd586
  • SHA1 5d49cfaf8f981da42f69f90330de581d74052089
  • SHA512 f224b5b531b13a6307234882b2acadb4a1a33606dce34e39d680dbf21f9c0f3b7fbf3585feee31921a37a4dc9da4a4b5fdd3d86adea557a20c855e01de222f68
  • SSDEEP 6144:bmtWELbywohIOBq1k2nPt83h2g3CkU0VB:bmtn/uhIDHq3hBSpO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2