amadey | d895a1fe45b9330f314baf1833f5663f1bcd29be84f03052ed157127ad4ee479 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

d895a1fe45b9330f314baf1833f5663f1bcd29be84f03052ed157127ad4ee479
Size

780KB
Sample

221126-efgnrsdf4y
MD5

f0c185e6b021663740d2fd5521a20c33
SHA1

40b4657f8dc47318dc869f5dc1c037633510260c
SHA256

d895a1fe45b9330f314baf1833f5663f1bcd29be84f03052ed157127ad4ee479
SHA512

17ca79e985019f56630ddd533371e6e9297f77832a3ee11779c3c5b5b6e8bde08db113dad7d8e8ccb905d4b5a512a588de7138f97bc81a5cc14c67955aee77d0
SSDEEP

12288:M7T+kWJc7161BOrx4l/7B1pVqfjKh1OWUsIOiizzMRK34+NBR:MnVr71OK8Dn2bKfYlizz0K3x

Score

10^/10

amadey collection spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

d895a1fe45b9330f314baf1833f5663f1bcd29be84f03052ed157127ad4ee479.exe

Resource

win10-20220812-en

amadey collection spyware stealer trojan

windows10-1703-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

amadey

Version

3.50

C2

77.73.134.65/o7VsjdSa2f/index.php

Targets

- Target
  
  d895a1fe45b9330f314baf1833f5663f1bcd29be84f03052ed157127ad4ee479
- Size
  
  780KB
- MD5
  
  f0c185e6b021663740d2fd5521a20c33
- SHA1
  
  40b4657f8dc47318dc869f5dc1c037633510260c
- SHA256
  
  d895a1fe45b9330f314baf1833f5663f1bcd29be84f03052ed157127ad4ee479
- SHA512
  
  17ca79e985019f56630ddd533371e6e9297f77832a3ee11779c3c5b5b6e8bde08db113dad7d8e8ccb905d4b5a512a588de7138f97bc81a5cc14c67955aee77d0
- SSDEEP
  
  12288:M7T+kWJc7161BOrx4l/7B1pVqfjKh1OWUsIOiizzMRK34+NBR:MnVr71OK8Dn2bKfYlizz0K3x
Score

10^/10

amadey collection spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeycollectionspywarestealertrojan

© 2018-2024

Terms | Privacy