General
-
Target
file.exe
-
Size
206KB
-
Sample
221126-dlsgsagd58
-
MD5
5483c6f7dc6d104b753f4d8f91eab464
-
SHA1
e16711422e1afb1492c1ca2021eef4a4e6309131
-
SHA256
4d96a5e592858c4ceb75633e43d11d956b39f8a2ab6bb8d3c9318f0d2615a927
-
SHA512
2f5d3ea78538db8d5b8a2c0af4b35bc58bc7ffb8f46f3b48e17b9284fb4f59af90be2c5da148a345ad4559a3fd38471ab75ba78fd0ef0e5f349cecb6082afa4c
-
SSDEEP
3072:P0JgBhCMgY+0k65SsvHGG3Xg1SK18XyMwLIdQQBSFJMUHl06U/L+TtiA4/3NV9Q:PhSMB+cvHnHgQG8CMwLIeFJjW6IyYAo
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Targets
-
-
Target
file.exe
-
Size
206KB
-
MD5
5483c6f7dc6d104b753f4d8f91eab464
-
SHA1
e16711422e1afb1492c1ca2021eef4a4e6309131
-
SHA256
4d96a5e592858c4ceb75633e43d11d956b39f8a2ab6bb8d3c9318f0d2615a927
-
SHA512
2f5d3ea78538db8d5b8a2c0af4b35bc58bc7ffb8f46f3b48e17b9284fb4f59af90be2c5da148a345ad4559a3fd38471ab75ba78fd0ef0e5f349cecb6082afa4c
-
SSDEEP
3072:P0JgBhCMgY+0k65SsvHGG3Xg1SK18XyMwLIdQQBSFJMUHl06U/L+TtiA4/3NV9Q:PhSMB+cvHnHgQG8CMwLIeFJjW6IyYAo
Score10/10-
Detect Amadey credential stealer module
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-