General
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
180KB
-
Sample
221126-bz2aqsff51
-
MD5
f51436b142ea3f2d17f8d9c7a44b892a
-
SHA1
8ef6994b22eebb03ed55216af08f8e19d42adc8e
-
SHA256
697f8e01b2e696a450de462e46b45237464d77ca8812ae4a193005a0501cab9f
-
SHA512
5d691dbadea4601e06eb0d9069c6fd0902d0d6399fd30f42f3ae03833e77bc026d13cf5fe06c27d8bc049e65ccf4e83ccc37b453a7ecebd5d1e611a3eeb24280
-
SSDEEP
3072:PAi2QTiMPMGLc8Kt7kFSHFaBeQTAYA3IBDWyBQjFFOeIY65FyjwWe:IPQTiQZrKt7kFSCTBA3IkBjFsg6DN9
Static task
static1
Behavioral task
behavioral1
Sample
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Targets
-
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
237KB
-
MD5
56ea74271bbecfd918a3fc9c8bbc4b78
-
SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571
-
SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1
-
SSDEEP
3072:0+2N06qhEjfT8d5DW7ilAaBeQtAYA3IBDWyBQj8ydRQUWlUFenKomY:RXEjfToWuHtBA3IkBj7PWlUKKfY
Score10/10-
Detect Amadey credential stealer module
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-