Extracted

• • Target

    94a3e5e9c0f7ab986288e6d2a7d114b6c29a2b84e987b93664fe30d780269846.exe

  • Size

    296KB

  • MD5

    057a799180c18080fd665a2f3d913f92

  • SHA1

    e7b81aefce06659570e481f95cfd41c907f96e98

  • SHA256

    94a3e5e9c0f7ab986288e6d2a7d114b6c29a2b84e987b93664fe30d780269846

  • SHA512

    58451aef2c255ef51d9603d3152c5e5972f1248062aa79913069a23630a352e87fce08735bceadccf7e53924c37753fd4d9d2e061df157374716b9c57d6b08fb

  • SSDEEP

    3072:6XfFR4LqagDqNR5OeHP8fDFhwfMMlLY1G5Jf4kPopVGqmGM1jzMHU77b/MerzzNT:a9+Lqaguh0fJASkP8gqmd1jwHUlzBCa

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2