Extracted

• • Target
    file.exe
  • Size 300KB
  • SHA256 bf1e6bbfa8c3819c2f04adc4289490758cf970f095dd93404405e0cd4e47f809
  • MD5 8b52a648ad93ce656937ca53af834340
  • SHA1 0cd27f03c54aebf64ed1212b22cb4617b46d9613
  • SHA512 4c5a8cb06a7f8fd1bbd600d3648c0079f212446b82f94026fd06fed60b50d695a380b702175af4e4191bd23928f69de8ea51a92fef1971a18fdc4a5840e8ae7d
  • SSDEEP 6144:9L33gvd1KVoX51PhdSt5nIrcOWo9CTqxrjiDtmmUXT:9Lgv7Kip1PhdSt5IIu98qViDtmtT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2