Extracted

• • Target

    3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348

  • Size

    420KB

  • MD5

    7b432411c12d3d0d31ecaf9011450e42

  • SHA1

    968943d42ba1e8938989b6ed1884195c2285396f

  • SHA256

    3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348

  • SHA512

    6881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b

  • SSDEEP

    6144:lfBwgfV+aXoGJR1xpppStlxu4qGilNZZDLxFLWj4+36o9:l3V+anFxZUq1NZJ9N8qu

  Score

  10^/10

  amadeyspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2