Extracted

• • Target

    64aca7057a61b52f8630a3e5e312efd0c0a2004c1596cdef29d483f8e97b346a.exe

  • Size

    292KB

  • MD5

    5b77d1b9121cbbeebe3f4e5c078380b5

  • SHA1

    433de61d420d74a6cf92d2cbe7e10eda0e33c7d4

  • SHA256

    64aca7057a61b52f8630a3e5e312efd0c0a2004c1596cdef29d483f8e97b346a

  • SHA512

    f5da160a7cb0195d51e578a51175fe8ccf209d633e6e852e163c64d2462fd91ab46a00f3660bae7a93443845f25e3d86ead4d722727a386932baaf689f1b3015

  • SSDEEP

    3072:9usm5zdjqLkkqdID8TUtxbuDlnT0psj+RIdoZV3yZHQjfw0YJdPz8LJlCNDTvgWH:oKJQIhsyRI4V3yZHQTFYJp+lqTvgj

  Score

  10^/10

  amadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2