Extracted

• • Target

    tmp

  • Size

    364KB

  • MD5

    624053fd08cbbd4b037d42abf3bebccf

  • SHA1

    9cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0

  • SHA256

    232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a

  • SHA512

    0d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6

  • SSDEEP

    6144:1IlO3QxkS7Vhc6l3qbPar3jriFa5gMfSuK+yJXsnGqgHt56b2:iqQxDpq6l3qbParyFa5/SVlvq5K

  Score

  10^/10

  amadeycollectioncredmodulespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

    credmodule

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2