Extracted

• • Target
    file.exe
  • Size 301KB
  • SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
  • MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
  • SHA1 4089d87a23e17d74b45fb313da3495525030c241
  • SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
  • SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2