amadey

General

Target

05dc210ff0d8c4ae657851fbf03e6e0309b955ba220acda5f34d55b6a5878bfb
Size

271KB
Sample

221116-f5a3ysdb7y
MD5

066704dc0cd6b584e78b0096feb8d73d
SHA1

ba6974805734fbb049b074b3adcc60800c24601e
SHA256

05dc210ff0d8c4ae657851fbf03e6e0309b955ba220acda5f34d55b6a5878bfb
SHA512

923c20e12e6a0ea6f97b938b0edbcecd6a5973d272de948d075068c38b996d05d43749a45b741357ca7f0bcde71a4411cab69bd5360085949af428759ed32f8d
SSDEEP

6144:/AFUK0Lexg2VPF21cQL2tAgroYfxl4qyx:oGFKxg2C152GgrpxlRu

Score

10^/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Targets

- Target
  
  05dc210ff0d8c4ae657851fbf03e6e0309b955ba220acda5f34d55b6a5878bfb
- Size
  
  271KB
- MD5
  
  066704dc0cd6b584e78b0096feb8d73d
- SHA1
  
  ba6974805734fbb049b074b3adcc60800c24601e
- SHA256
  
  05dc210ff0d8c4ae657851fbf03e6e0309b955ba220acda5f34d55b6a5878bfb
- SHA512
  
  923c20e12e6a0ea6f97b938b0edbcecd6a5973d272de948d075068c38b996d05d43749a45b741357ca7f0bcde71a4411cab69bd5360085949af428759ed32f8d
- SSDEEP
  
  6144:/AFUK0Lexg2VPF21cQL2tAgroYfxl4qyx:oGFKxg2C152GgrpxlRu
Score

10^/10

amadey eternity collection persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1