Overview

overview

10

Static

static

cc6573c4ad...c8.exe

windows7-x64

10

cc6573c4ad...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc6573c4ad6f0700c00a02ed4bc305107eecd995f1612be99f07f318017efec8

  • Size

    174KB

  • Sample

    221126-axvjqshh44

  • MD5

    b8792a0cb80f91d3f088002d282a7d74

  • SHA1

    864b9f854652cb0e50d61e207597665e3efe7d06

  • SHA256

    ff4423cf738ef4f01252e66876fc424655d20353d2409f6fd61e292e0a24ad85

  • SHA512

    237c7242155a7d0baff838339a8824b2a69395d6458e7433831e5a0a8150df3142f98d49b1a0e4f3ee67145fee84bbdfa28156ccf66d07715148d7fa023b8165

  • SSDEEP

    3072:/tLiaBRHJFlEf3OwqRDlE9Bd6BQDLNilRwsrRJ4uQmuv7n7AG+KURw:/t+a3HJFlEf+BDkaBQXNwwyJ4jmuv7nt

Score
10/10
amadeycollectionspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.194/h49vlBP/index.php

Targets

    • Target

      cc6573c4ad6f0700c00a02ed4bc305107eecd995f1612be99f07f318017efec8

    • Size

      226KB

    • MD5

      cdd4c17bc79e0e111d637b515d7b20df

    • SHA1

      6b644f1606f5a2af380ca1dc720c7eb2fd21b1fc

    • SHA256

      cc6573c4ad6f0700c00a02ed4bc305107eecd995f1612be99f07f318017efec8

    • SHA512

      d7f4ffad5cca735d073e0b4dff54635a62170015a109e18ff227f864654d9f0c7fed76ed3019fd1badc7eedd9046b9bc526d96a20c554e5f6e2480d886eb31ed

    • SSDEEP

      6144:gpKes0N5fHjkaBQXjwwyJ4jmuv7nM12pzn:Xes0NtjNBNL4jV7n5

    Score
    10/10
    amadeycollectionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks