Extracted

• • Target

    da6b899d237cb13c3eb55729843e1591aa5c69af11f4aae65071938b8e7856d6

  • Size

    281KB

  • MD5

    e212c89e450a9cbb009d61f3c5590b68

  • SHA1

    456ee91cd18858763e6967b2c6c2a1dd4ef3af5e

  • SHA256

    da6b899d237cb13c3eb55729843e1591aa5c69af11f4aae65071938b8e7856d6

  • SHA512

    8fdecc2f023b95f2eedef75bb0f72130646afa91861f12fa4d529226dab2e0a9bc27446214f7d54dce7ff2c7131041dfc8c325756707b3319de1057ebb2720e2

  • SSDEEP

    6144:HL5r3Ub/Mf/a6ZrRcJTccaoAJ3Up1aMsz:HNr3Uh6ZFAgu+Jz

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1