Overview

overview

10

Static

static

AVISO21203...85.exe

windows7_x64

10

AVISO21203...85.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AVISO21203315400875390289906651441762884335887984616964056633077143552985.exe

  • Size

    330KB

  • Sample

    210423-6gplr8txv2

  • MD5

    5feab3a8376b418614a81652c4d9ccf8

  • SHA1

    9ea435fc48391ab715987dbfa8fd396e94fe8e40

  • SHA256

    4c46a33d520a8cde562b5c241adf95ccd0eaefb26ac5a161abefa5a1bb4b420b

  • SHA512

    730c88b3d33b78410c2db8940d60a7f07592cfed618cf2d20c65c8e481e459fe64945e1329c56dd24c793b09dd9867ef19f157b0764c1d7c038fe71ba6c82e3a

Score
10/10
amadeyspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

176.111.174.67/7Ndd3SnW/index.php

Targets

    • Target

      AVISO21203315400875390289906651441762884335887984616964056633077143552985.exe

    • Size

      330KB

    • MD5

      5feab3a8376b418614a81652c4d9ccf8

    • SHA1

      9ea435fc48391ab715987dbfa8fd396e94fe8e40

    • SHA256

      4c46a33d520a8cde562b5c241adf95ccd0eaefb26ac5a161abefa5a1bb4b420b

    • SHA512

      730c88b3d33b78410c2db8940d60a7f07592cfed618cf2d20c65c8e481e459fe64945e1329c56dd24c793b09dd9867ef19f157b0764c1d7c038fe71ba6c82e3a

    Score
    10/10
    amadeyspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks