Extracted

• • Target

    6b3383ad0a767b008e8a41db84efea8847de86796aefd3703dcecb7ec3203e27

  • Size

    5.2MB

  • MD5

    294593fcb93a6d6694c9670e86e649bf

  • SHA1

    fd861b0d33cc076ded2987c94fa9860e0c4aadd0

  • SHA256

    6b3383ad0a767b008e8a41db84efea8847de86796aefd3703dcecb7ec3203e27

  • SHA512

    427456fb736238333a83b9760b27885998a32e3f29d38690774430e7bbea1bf9b08c1c6fc23583bd15908d0aed4e494f8b8853e17f52c49193d0624769b94350

  • SSDEEP

    98304:a3t1ASlTBJNo0uwOBq+X9vV2vJmWVFJqP54CzfhnCiOFXrOzxdIoDL/dHMeGT2uV:a91jBJNWwOBq+X5mFGJhnGyzxdh2XFL

  Score

  10^/10

  amadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1