amadey | b4dd55d73615efe8f43238e5e4fa3f94ed16b00a054a4130be23b011ab948b4e | Triage

Sharing

General

Target

SEGURIDAD44691843410749597156161190242668039433797773842658464605841100935878.exe
Size

330KB
Sample

210413-876tgxl9ee
MD5

1978e8a34b5178485275e2200cde5d14
SHA1

4b69cd44159b1ed5e70686ca786162c7f164ae2f
SHA256

b4dd55d73615efe8f43238e5e4fa3f94ed16b00a054a4130be23b011ab948b4e
SHA512

995edd54459ac90c4c44a0d91fb21257e203f35cc9266a82bbd80863b20c2ca0475cfebabe7aa2435dce62f95cd02f381d2b6eb9625adb35ae52d91a08a7fbc4

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

176.111.174.67/7Ndd3SnW/index.php

Targets

- Target
  
  SEGURIDAD44691843410749597156161190242668039433797773842658464605841100935878.exe
- Size
  
  330KB
- MD5
  
  1978e8a34b5178485275e2200cde5d14
- SHA1
  
  4b69cd44159b1ed5e70686ca786162c7f164ae2f
- SHA256
  
  b4dd55d73615efe8f43238e5e4fa3f94ed16b00a054a4130be23b011ab948b4e
- SHA512
  
  995edd54459ac90c4c44a0d91fb21257e203f35cc9266a82bbd80863b20c2ca0475cfebabe7aa2435dce62f95cd02f381d2b6eb9625adb35ae52d91a08a7fbc4
Score

10^/10

amadey spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

amadeyspywarestealertrojan

behavioral2

amadeyspywarestealertrojan