amadey

General

Target
file.exe
Size 189KB
Sample221109-tvsrxaacc8
SHA256 6a37c10bfbb386f63bfa5e3a4894a9c24defa658a69dc3c65c5bb7a5e5c9fac7
MD5 37baee15b958483161bca383eac04d74
SHA1 d4556d5d33efabf07c734efe4cbec68ce5f39cb9
SHA512 7feff62272fad28c9bef561ec051539c856528a9896aa42dc5b4f1fab31f2df9057ca932f8d2c170df58eb477500b4d401426f940c5da40867391ed29387abde
SSDEEP 3072:ZWyXtw4gpFOWBdeALjBQuAT/K7R6X5n7w4CG/sWZesYsf1v6uoe6:PtYpdLjBQuATBpMxJU1Auo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 189KB
- SHA256 6a37c10bfbb386f63bfa5e3a4894a9c24defa658a69dc3c65c5bb7a5e5c9fac7
- MD5 37baee15b958483161bca383eac04d74
- SHA1 d4556d5d33efabf07c734efe4cbec68ce5f39cb9
- SHA512 7feff62272fad28c9bef561ec051539c856528a9896aa42dc5b4f1fab31f2df9057ca932f8d2c170df58eb477500b4d401426f940c5da40867391ed29387abde
- SSDEEP 3072:ZWyXtw4gpFOWBdeALjBQuAT/K7R6X5n7w4CG/sWZesYsf1v6uoe6:PtYpdLjBQuATBpMxJU1Auo
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan amadey collection persistence spyware stealer upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2