amadey

General

Target

e6f7e51e1d9155d6c5ddd9f6c8316d26d720b0c879a15bb99c63614cb599c46a
Size

430KB
Sample

220623-r7p6fadehk
MD5

f5444f9b10f1ce59b1c93e426382c98e
SHA1

e98f8ad70a59c9bde882f56d4f48d33e6d7ffae7
SHA256

e6f7e51e1d9155d6c5ddd9f6c8316d26d720b0c879a15bb99c63614cb599c46a
SHA512

a6e2f3c168d59bf4407cef0cb84868a548947ac89efc143832681e7f1ff2070669ad91141797a2ea04f82dd67b2c7b9d743676d5b64c437fb30bb9dfe37abf0c

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

52.7

Botnet

1448

C2

https://t.me/tg_superch

https://climatejustice.social/@olegf9844

Attributes

profile_id
1448

Extracted

Family

amadey

Version

3.21

C2

185.215.113.15/Lkb2dxj3/index.php

Targets

- Target
  
  e6f7e51e1d9155d6c5ddd9f6c8316d26d720b0c879a15bb99c63614cb599c46a
- Size
  
  430KB
- MD5
  
  f5444f9b10f1ce59b1c93e426382c98e
- SHA1
  
  e98f8ad70a59c9bde882f56d4f48d33e6d7ffae7
- SHA256
  
  e6f7e51e1d9155d6c5ddd9f6c8316d26d720b0c879a15bb99c63614cb599c46a
- SHA512
  
  a6e2f3c168d59bf4407cef0cb84868a548947ac89efc143832681e7f1ff2070669ad91141797a2ea04f82dd67b2c7b9d743676d5b64c437fb30bb9dfe37abf0c
Score

10^/10

amadey vidar 1448 collection discovery spyware stealer suricata trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Amadey CnC Check-In
  suricata: ET MALWARE Amadey CnC Check-In
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata
- suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
  suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
  suricata
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1