Extracted

Extracted

• • Target

    14d66fae295c4682378f217a5d9db1f5.exe

  • Size

    541KB

  • MD5

    14d66fae295c4682378f217a5d9db1f5

  • SHA1

    5629006413f2b4419cbb1f89ee42e84dacfebbdc

  • SHA256

    74d64a5862f2275e539303f6753ee66ff0f423862764db87b75b10d6b93b87ae

  • SHA512

    82414417fef7a017bb82656c55f1ca4d09e82e350ea41cef8459657ab370ce8d074d98559a50be27bb56392e9547a5c123874a2137d3f6851498cefabc31a3a5

  • SSDEEP

    12288:4VWeGVQ9e+T9lDxD2tfiT0/yxltck74orKcj7I7Dov:4Ee1T9lt2taayxl+24orKcA7Dov

  Score

  10^/10

  amadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2