amadey

General

Target

28bf368178051f91e19150c4e52806cc.exe
Size

271KB
Sample

221117-j9kdzaea34
MD5

28bf368178051f91e19150c4e52806cc
SHA1

6afc716814857c04fdfb301be034aeeaa6b4f5ac
SHA256

b5c70be2efa234a02e2becde40c95f71a35a3b8b528487a0d75619e4f0c6cf16
SHA512

a46179ee5d345a45e58bdffe84e2a3620bd7cbc5f5ac970be23d5fcdff3308bfeddfdcdc6640a598946e290af9d4f1d14370e7eef9f7fa53811e71a1a73556c6
SSDEEP

6144:klCLhTz/OOMwtbSErRXIYU0UD1CkcLjTwGUUs:k8Nz/OwbSIq0yC137UF

Score

10^/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Targets

- Target
  
  28bf368178051f91e19150c4e52806cc.exe
- Size
  
  271KB
- MD5
  
  28bf368178051f91e19150c4e52806cc
- SHA1
  
  6afc716814857c04fdfb301be034aeeaa6b4f5ac
- SHA256
  
  b5c70be2efa234a02e2becde40c95f71a35a3b8b528487a0d75619e4f0c6cf16
- SHA512
  
  a46179ee5d345a45e58bdffe84e2a3620bd7cbc5f5ac970be23d5fcdff3308bfeddfdcdc6640a598946e290af9d4f1d14370e7eef9f7fa53811e71a1a73556c6
- SSDEEP
  
  6144:klCLhTz/OOMwtbSErRXIYU0UD1CkcLjTwGUUs:k8Nz/OwbSIq0yC137UF
Score

10^/10

amadey eternity collection persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2