amadey | bf416ba5655a2e13b7796c606a746445a453cc9cb69ba17a117f9aad8cb90d15 | Triage

Sharing

General

Target

CONTRASEÑA.001
Size

181KB
Sample

210414-97jfgdhnde
MD5

02aa6bace867806c1b7e86364f439b8a
SHA1

d5f13b1cd0a7a6d39a8ab543603e92e17cdfceb6
SHA256

bf416ba5655a2e13b7796c606a746445a453cc9cb69ba17a117f9aad8cb90d15
SHA512

7e1c19032548f987ad45b27e3ab8e267d5b4fb8b1aad80926ab2a35e793f4b923a6d3e176add3fa80dc8860f8f9dc81694313d3d394c7e97fcc0702cf5f58b79

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

176.111.174.67/7Ndd3SnW/index.php

Targets

- Target
  
  CONTRASEÑA43175507342514560151095116626174482252188659007214545157719538098233653418638550016741.exe
- Size
  
  296KB
- MD5
  
  b46b7f0cb1f1e61bcc4bfddacd926fb8
- SHA1
  
  067cd485e44a2015a604a200ab2617cdc7c872c5
- SHA256
  
  e630ad9b611bbabd87e2ece828f57bfda70d0a64ec34c3f786b516771f59fb96
- SHA512
  
  b85c20a2bffdec84d133e41725c402ba860ae2728883f0570d7d38849582860fafa8313809f79101d0a0c14922fe60a1789de57d337a6666779ee7aa7530ea5a
Score

10^/10

amadey spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

amadeyspywarestealertrojan

behavioral2

amadeyspywarestealertrojan