Extracted

• • Target
    file.exe
  • Size 301KB
  • SHA256 59bb9cb2e2303067e37fbe85becdf96f81ceef791356da211e877a62295cb890
  • MD5 f5af08280daf5e2361557111f9a42949
  • SHA1 88736bf48a823138d50b1395c8bdb874bc35d045
  • SHA512 d8bfec17bece8aff6038d793a03bc703be7ac4df90ac7f1449a14c9f0d1a5abf992d7fc032667ca81774ca99a2660ba0e7d6b110f00f4c9a06ce3dd5f0195df5
  • SSDEEP 3072:QPHtLGls5SVgDScCKxV1u2/kSS+m0j36x9eTAfHFTwIbxM2ECeG7h18wDDtdmdhB:GL2Fqhdf+0j3xcRxM2EM18iDtmmUXT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2