Extracted

• • Target

    1a9fcc9824192930be4f99536934ce03a2e06ab428097285aa1617e9c4c87d30

  • Size

    273KB

  • MD5

    c5e6b0ddf6414795b054b7448380e1e5

  • SHA1

    fcbe111058babc8078836b603cc9b5b72407a638

  • SHA256

    1a9fcc9824192930be4f99536934ce03a2e06ab428097285aa1617e9c4c87d30

  • SHA512

    266dd087a6798e35cfacb94f8e3d260c61c9bca876f1746532233901367181886ca65ba21772eedbadb6606d695f46e56d4e2c800a597760be39189159c572ed

  • SSDEEP

    6144:Jd5KBLJk9cxa5tTNHKgODZP+VAFwV8Il+rjjlVklPH:JTi1UcKFKgA+VI2MlU

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1