Extracted

Extracted

• • Target

    eafccb8a097ebfd717b810a6174522e00037957c2deb8681a76c461ad572b47a

  • Size

    422KB

  • MD5

    5a8beeebeb73ccf8f1cc295052b5c45a

  • SHA1

    9fc73805f46e9bbeb02e26c3bda381f47956751e

  • SHA256

    eafccb8a097ebfd717b810a6174522e00037957c2deb8681a76c461ad572b47a

  • SHA512

    13b57e7624b4512f8c46dd46ec4582583e81ef338d508c96ad866bbd452f25a1fd1d08d4ab53354278bc3bf0bdc5d752db6cbe13df1e3fcd1a0fb4be796f71a0

  • SSDEEP

    6144:tUHzd9/7JLzLyXW1UhiDSQpKRVkuc2JhQ6JJLML6mR:tUHzd9/NLzLAoU4z2TLJJLM

  Score

  10^/10

  amadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2