amadey | b61d968799d67e9061e759856e554974b644f18cba888addb3ced45462291c91 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

b61d968799d67e9061e759856e554974b644f18cba888addb3ced45462291c91
Size

205KB
Sample

221126-jr97nsdc76
MD5

4df955dcd23f20f6aea2bd174c44dca9
SHA1

466b8734b8874bf880c6b451ec099cae531a1bc3
SHA256

b61d968799d67e9061e759856e554974b644f18cba888addb3ced45462291c91
SHA512

41015d3f8390af1463e78e2e05c38b6efdc537eebf0a9254be081badd0371dfd5a72b79d56e3590d23a067cb7500854e0efd0a496a8d50207b0549331ac19003
SSDEEP

3072:ODa6j9gj4hm6655eHurt4cwDN974w+Yc8XuRDXSbGKWhVSo9jns5niOwRclQ:v6gchJurt43DXx+YclDvK0fs5nAJ

Score

10^/10

amadey collection spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

b61d968799d67e9061e759856e554974b644f18cba888addb3ced45462291c91.exe

Resource

win10v2004-20220812-en

amadey collection spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.17/hfk3vK9/index.php

Targets

- Target
  
  b61d968799d67e9061e759856e554974b644f18cba888addb3ced45462291c91
- Size
  
  205KB
- MD5
  
  4df955dcd23f20f6aea2bd174c44dca9
- SHA1
  
  466b8734b8874bf880c6b451ec099cae531a1bc3
- SHA256
  
  b61d968799d67e9061e759856e554974b644f18cba888addb3ced45462291c91
- SHA512
  
  41015d3f8390af1463e78e2e05c38b6efdc537eebf0a9254be081badd0371dfd5a72b79d56e3590d23a067cb7500854e0efd0a496a8d50207b0549331ac19003
- SSDEEP
  
  3072:ODa6j9gj4hm6655eHurt4cwDN974w+Yc8XuRDXSbGKWhVSo9jns5niOwRclQ:v6gchJurt43DXx+YclDvK0fs5nAJ
Score

10^/10

amadey collection spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeycollectionspywarestealertrojan

© 2018-2024

Terms | Privacy