Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    267KB

  • Sample

    221101-e5lzsagae6

  • MD5

    fae498c90e3d973cdc44e7726f388f57

  • SHA1

    6dd44958a09cb16294b18600aed0b1c0edfe514b

  • SHA256

    58936bd229a9c9be5bd790d8bd7f17c7ef783f95dea6300c67f19a854520a19d

  • SHA512

    3972b0ad570fcb74fec46230a43e07ed50258aaa8bcee525625170f1e88962d60184413ddac28c335fbcc11b530fbd8444fadabd55622e80153d58a38404d267

  • SSDEEP

    6144:6ppaaBZ/ubLASm6BMgj3iMnueV80FHcVnEya5:6pQarCjm0Li/eyZnED

Score
10/10
amadeycollectionspywarestealertrojan

Malware Config

Targets

    • Target

      file

    • Size

      267KB

    • MD5

      fae498c90e3d973cdc44e7726f388f57

    • SHA1

      6dd44958a09cb16294b18600aed0b1c0edfe514b

    • SHA256

      58936bd229a9c9be5bd790d8bd7f17c7ef783f95dea6300c67f19a854520a19d

    • SHA512

      3972b0ad570fcb74fec46230a43e07ed50258aaa8bcee525625170f1e88962d60184413ddac28c335fbcc11b530fbd8444fadabd55622e80153d58a38404d267

    • SSDEEP

      6144:6ppaaBZ/ubLASm6BMgj3iMnueV80FHcVnEya5:6pQarCjm0Li/eyZnED

    Score
    10/10
    amadeycollectionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks