Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    362KB

  • Sample

    221102-zkt5wabfg2

  • MD5

    2771f40e748283709fe403033dcf9235

  • SHA1

    7da9930191a6f95a1113bf124dbc8de3e19bf0b3

  • SHA256

    fe53786878fcacc53d8ec670dc3b0bc6113e046e31b6ce5ae09d748ef2158683

  • SHA512

    b5e4d10bbabb0fa6f5b0bf993093cb050fa609eff60828493343dded9e097575ffde5fb51090f34cccd1369dacf342ae72503ba15315c3dc879b3dfe117934a2

  • SSDEEP

    6144:Bb/aL8C4ElGeqF+qJIKixopeQTLp7ITsq:h/aIC4SGeqF+qJJixkeQTl7

Score
10/10
amadeycollectionspywarestealertrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      362KB

    • MD5

      2771f40e748283709fe403033dcf9235

    • SHA1

      7da9930191a6f95a1113bf124dbc8de3e19bf0b3

    • SHA256

      fe53786878fcacc53d8ec670dc3b0bc6113e046e31b6ce5ae09d748ef2158683

    • SHA512

      b5e4d10bbabb0fa6f5b0bf993093cb050fa609eff60828493343dded9e097575ffde5fb51090f34cccd1369dacf342ae72503ba15315c3dc879b3dfe117934a2

    • SSDEEP

      6144:Bb/aL8C4ElGeqF+qJIKixopeQTLp7ITsq:h/aIC4SGeqF+qJJixkeQTl7

    Score
    10/10
    amadeycollectionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks