General
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
180KB
-
Sample
221126-bq26nsbh87
-
MD5
6d8443b4c8c3d4984af7f146946dc85e
-
SHA1
a7bf9eaa859456a38093eb0ffa1e6c8186d1a928
-
SHA256
ef687584013581fddc602589cc1f2a3dd85cdc6c596c069d1d6bb3d589517051
-
SHA512
a5dc8ddc8ba74a32db553607a574823f2fbc160416bd784322d343a7ece6100ff1ab1ae7774cdccced5600e3657f5f15bdd5df87f27b05c5b164bc7ed9ffb327
-
SSDEEP
3072:nAi2QTiMPMGLc8Kt7kFSHFaBeQTAYA3IBDWyBQjFFOeIY65FyjwWW:APQTiQZrKt7kFSCTBA3IkBjFsg6DNl
Static task
static1
Behavioral task
behavioral1
Sample
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Targets
-
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
237KB
-
MD5
56ea74271bbecfd918a3fc9c8bbc4b78
-
SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571
-
SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1
-
SSDEEP
3072:0+2N06qhEjfT8d5DW7ilAaBeQtAYA3IBDWyBQj8ydRQUWlUFenKomY:RXEjfToWuHtBA3IkBj7PWlUKKfY
Score10/10-
Detect Amadey credential stealer module
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-