amadey | b5a399c0ea40983abc68b828ccb14efde2db90c047bbfba9ae418317ce7f036d | Triage

Sharing

General

Target

b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Size

283KB
Sample

210428-ya3hzfqxlj
MD5

31ab82365078548dcea62da7c2380b2e
SHA1

712fbb4df005439b9810090fd3a2962848e252c4
SHA256

b5a399c0ea40983abc68b828ccb14efde2db90c047bbfba9ae418317ce7f036d
SHA512

937bfd9845cc25a6739b8df0cac685c5499f4d55d5f70fff5ce61a4569b7be96d84e987e001b8e8109200c485f681bcc86911a29cc5e5e45b978dbace7da2ce3

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

2.16

C2

176.111.174.114/Hnq8vS/index.php

Targets

- Target
  
  b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
- Size
  
  283KB
- MD5
  
  31ab82365078548dcea62da7c2380b2e
- SHA1
  
  712fbb4df005439b9810090fd3a2962848e252c4
- SHA256
  
  b5a399c0ea40983abc68b828ccb14efde2db90c047bbfba9ae418317ce7f036d
- SHA512
  
  937bfd9845cc25a6739b8df0cac685c5499f4d55d5f70fff5ce61a4569b7be96d84e987e001b8e8109200c485f681bcc86911a29cc5e5e45b978dbace7da2ce3
Score

10^/10

amadey spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

amadeyspywarestealertrojan

behavioral2

amadeyspywarestealertrojan