Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b31d31314be8ef931088d03ac7fff7f3431619d0abadac320e364a8e49de4c5

  • Size

    206KB

  • Sample

    221127-f65zqagb6t

  • MD5

    caa2b9781b5aae691347298ecec8e7e7

  • SHA1

    44aeb2cd466d820e23ae91bff755033905b4124c

  • SHA256

    1b31d31314be8ef931088d03ac7fff7f3431619d0abadac320e364a8e49de4c5

  • SHA512

    c82f3d99d1e037cdd67f3972e0b63ad38b46fdc1a3c4e0036f0ca6e9d379f036f1592766192280666e86736eb54eae81e4775bfa862a4d2eb72c7220a00b122a

  • SSDEEP

    3072:W4aBeDQyO0mB52OXrKRIR5kZqa8+kfBexT9vuEjX4qAWYj5VZCs6plryJAmF:eLB0J6zajkfB8xG8otWYjbos6j/m

Score
10/10
amadeycollectionspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.194/h49vlBP/index.php

Targets

    • Target

      1b31d31314be8ef931088d03ac7fff7f3431619d0abadac320e364a8e49de4c5

    • Size

      206KB

    • MD5

      caa2b9781b5aae691347298ecec8e7e7

    • SHA1

      44aeb2cd466d820e23ae91bff755033905b4124c

    • SHA256

      1b31d31314be8ef931088d03ac7fff7f3431619d0abadac320e364a8e49de4c5

    • SHA512

      c82f3d99d1e037cdd67f3972e0b63ad38b46fdc1a3c4e0036f0ca6e9d379f036f1592766192280666e86736eb54eae81e4775bfa862a4d2eb72c7220a00b122a

    • SSDEEP

      3072:W4aBeDQyO0mB52OXrKRIR5kZqa8+kfBexT9vuEjX4qAWYj5VZCs6plryJAmF:eLB0J6zajkfB8xG8otWYjbos6j/m

    Score
    10/10
    amadeycollectionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks