General
-
Target
6a59517bc0735d8437978ab13b7993b26ce793a69146341be32fa71180557aa7
-
Size
226KB
-
Sample
221125-x41qnach5s
-
MD5
75b4f9883d47a3f05d728a9bf35ea8da
-
SHA1
7cacfa6e2216196754800b9284a4c1d848a3ccb5
-
SHA256
6a59517bc0735d8437978ab13b7993b26ce793a69146341be32fa71180557aa7
-
SHA512
d162c0695b887a64f4c1808c37c467cf98e10b262aa7a110c4ff63440dc23759181887813d64d37e65aed179c59d4da8d054f1d38d8db4b81834a92f567a382f
-
SSDEEP
6144:Vg6JgBicZWiL/2aFxXC9+DatC/NjXZ0yZF+VD+dADM+8:rciye6xM+uyZN6CaI
Static task
static1
Behavioral task
behavioral1
Sample
6a59517bc0735d8437978ab13b7993b26ce793a69146341be32fa71180557aa7.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
amadey
3.50
31.41.244.17/hfk3vK9/index.php
Extracted
laplas
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Targets
-
-
Target
6a59517bc0735d8437978ab13b7993b26ce793a69146341be32fa71180557aa7
-
Size
226KB
-
MD5
75b4f9883d47a3f05d728a9bf35ea8da
-
SHA1
7cacfa6e2216196754800b9284a4c1d848a3ccb5
-
SHA256
6a59517bc0735d8437978ab13b7993b26ce793a69146341be32fa71180557aa7
-
SHA512
d162c0695b887a64f4c1808c37c467cf98e10b262aa7a110c4ff63440dc23759181887813d64d37e65aed179c59d4da8d054f1d38d8db4b81834a92f567a382f
-
SSDEEP
6144:Vg6JgBicZWiL/2aFxXC9+DatC/NjXZ0yZF+VD+dADM+8:rciye6xM+uyZN6CaI
-
Detect Amadey credential stealer module
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-