Extracted

Extracted

• • Target

    9ec768096c47d40c016a474b8b6dfec950673dfde82fcbd1a0c08dc0318b44ad

  • Size

    250KB

  • MD5

    b58edea3459e74011c931739ad7345f3

  • SHA1

    6b11a3c10e081dd63201abbf65bacb206e054240

  • SHA256

    9ec768096c47d40c016a474b8b6dfec950673dfde82fcbd1a0c08dc0318b44ad

  • SHA512

    ff781b5c94e92fcd06e84958cefd5ad63db0f0db1ff7fe02ec23a95fcf70ebbb04cec7a6e790b334050efbf2296b6cb3e1c6b619fe39a1f17227a298e2c6c132

  Score

  10^/10

  amadeysuricatatrojanrecordbreakercollectionpersistencespywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2