amadey | 32cac8a93cf8d3094bac0a16c46f6f69920239a292aa0e8e0ce034ab72f7f146 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

32cac8a93cf8d3094bac0a16c46f6f69920239a292aa0e8e0ce034ab72f7f146
Size

361KB
Sample

221102-jv45tsbagp
MD5

aa268b59256692b54889822c3e05d139
SHA1

89460c224ffa21502af9bbcdc0ac8700c5a15ccf
SHA256

32cac8a93cf8d3094bac0a16c46f6f69920239a292aa0e8e0ce034ab72f7f146
SHA512

761f48358dbd6717f4831a01246d9d5900b70c9d48046c770df1138b5e9c66748931ea7511c3b031d8e939b4e48bc50fabf90b5dfc89be733af1eb9242934327
SSDEEP

6144:Z8jLcBetfd2op6R47hSvhEAhf6jhrQ7ITsq4:Z80Be72j47Ih/N6dk75

Score

10^/10

amadey collection spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

32cac8a93cf8d3094bac0a16c46f6f69920239a292aa0e8e0ce034ab72f7f146.exe

Resource

win10v2004-20220812-en

amadey collection spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  32cac8a93cf8d3094bac0a16c46f6f69920239a292aa0e8e0ce034ab72f7f146
- Size
  
  361KB
- MD5
  
  aa268b59256692b54889822c3e05d139
- SHA1
  
  89460c224ffa21502af9bbcdc0ac8700c5a15ccf
- SHA256
  
  32cac8a93cf8d3094bac0a16c46f6f69920239a292aa0e8e0ce034ab72f7f146
- SHA512
  
  761f48358dbd6717f4831a01246d9d5900b70c9d48046c770df1138b5e9c66748931ea7511c3b031d8e939b4e48bc50fabf90b5dfc89be733af1eb9242934327
- SSDEEP
  
  6144:Z8jLcBetfd2op6R47hSvhEAhf6jhrQ7ITsq4:Z80Be72j47Ih/N6dk75
Score

10^/10

amadey collection spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeycollectionspywarestealertrojan

© 2018-2025

Terms | Privacy