Extracted

• • Target
    file.exe
  • Size 367KB
  • SHA256 b1fe15394d3a406b37ce60bacb43aa513b13dcf07f726cf801d1ddf7b0022b30
  • MD5 d211cf641f8a43ab99547ece3e75fce8
  • SHA1 40007d421cf0eafd99145dfde7e396df9acac33c
  • SHA512 a3bdf25c28b1e5c648960994f7594093a5935b529d40234869f5b34e2835e41b25c34e2dd28a4b8b654e2bcc459eeadfaa7f99085c8f5da05065f3e048672e58
  • SSDEEP 6144:jYCnsLtkpf5ap3sGksxMQkRQWAKBNKvzYi9+0iPvzpQ6ijLxQFiaI:vsBkpBaBsnswRbA7vF+xnzpQ6ijqF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeycollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2