Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6eef5cd7fdbc9bc19ccfd72c37ff4a0a595236f70f1006160c13a0784b0e66c7

  • Size

    223KB

  • Sample

    221107-z2t67scadk

  • MD5

    1a19ddfbf6ff34e600def420a0723dd0

  • SHA1

    0aaafe6efe4033548bf2d581cf8bcda69ddfea26

  • SHA256

    6eef5cd7fdbc9bc19ccfd72c37ff4a0a595236f70f1006160c13a0784b0e66c7

  • SHA512

    bcc55976cb8137f11f05c6040fa8408167d1609c3eb1558e3ccdbbde03c9e3611c9a1a177689c1e2452cf3002d1d95b4dbe3bb81d4a347c1687ddbc8a78716cb

  • SSDEEP

    3072:0PtevzsL6YoEUR1jBx9lkfld8e07vI0laP6O0sYCsMAhNfW39BHdjfVxOKwV:yjL6Yo1xRRUea6rHCsPhNfyfV

Score
10/10
amadeycollectionspywarestealertrojan

Malware Config

Targets

    • Target

      6eef5cd7fdbc9bc19ccfd72c37ff4a0a595236f70f1006160c13a0784b0e66c7

    • Size

      223KB

    • MD5

      1a19ddfbf6ff34e600def420a0723dd0

    • SHA1

      0aaafe6efe4033548bf2d581cf8bcda69ddfea26

    • SHA256

      6eef5cd7fdbc9bc19ccfd72c37ff4a0a595236f70f1006160c13a0784b0e66c7

    • SHA512

      bcc55976cb8137f11f05c6040fa8408167d1609c3eb1558e3ccdbbde03c9e3611c9a1a177689c1e2452cf3002d1d95b4dbe3bb81d4a347c1687ddbc8a78716cb

    • SSDEEP

      3072:0PtevzsL6YoEUR1jBx9lkfld8e07vI0laP6O0sYCsMAhNfW39BHdjfVxOKwV:yjL6Yo1xRRUea6rHCsPhNfyfV

    Score
    10/10
    amadeycollectionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks