Extracted

• • Target
    file.exe
  • Size 296KB
  • SHA256 bf2b57ec5048d574ad425e14ba2b184d6372b245eff964e63c10ff20a516d9a7
  • MD5 0d6891bd6a9a9a9b1f8513f861be8dfc
  • SHA1 b76583bd2b31ed165d77509d276e526aa414b606
  • SHA512 716ddbfbb998cacd00aa2736fff68bb813bbd0553204635a277a2b6c9919901b3501addfd18c7dc301bff6d05337077da89a3b1e0c284e53a507b250f29dd074
  • SSDEEP 6144:shMkR3Lf/aOaWPZO+80o7ZF+H5JVNr0w:shMkR3Lf/1aWZO30K+H0w
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2