Overview

overview

10

Static

static

e577def081...35.exe

windows7-x64

10

e577def081...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e577def081e7d44de97c7db5f2da1e35fbc19491d153d1ff9ddd7ebe85ee4d35

  • Size

    174KB

  • Sample

    221128-dvmb5abb58

  • MD5

    f16d7a852f6ef9cf67afd4f0cffbae7f

  • SHA1

    5cd546e4ea20b0eb73d43b7fcdbb3338ae871c47

  • SHA256

    a734ada67df18e3d2177cfedc49b66825fdec7f9f84d11c69d222e42196e82d5

  • SHA512

    0e2b56a02fcaf8d8b1312fe7952ac94ce767550acd0acab510e80c364d077f077a6280d1a32ae6c758d7c0d5bd1faae316ff4eb64ac0c185291f5ad90fb04a11

  • SSDEEP

    3072:IrMT/qtAai0Z2XQv7pW1Sye/PvHXXrlkzZDQGUd2f0ES9v7tx1VXI8p4iFwmtfdt:I4qtAaDZ2X87pW1SdPPXhUQGUdYWv7jR

Score
10/10
amadeycollectionspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.194/h49vlBP/index.php

Targets

    • Target

      e577def081e7d44de97c7db5f2da1e35fbc19491d153d1ff9ddd7ebe85ee4d35

    • Size

      226KB

    • MD5

      d264eff72e0fc5e1ba488a07b45b1cf7

    • SHA1

      b1d7fd92f5eeb19b22c06bedd06dcec12b0c3823

    • SHA256

      e577def081e7d44de97c7db5f2da1e35fbc19491d153d1ff9ddd7ebe85ee4d35

    • SHA512

      3340cc12e2adc11d950c3f26c38f1798da7839ee7d218e99578035bb311d85d1bfd25a7b88b3b34d6f13a9975af1ddb9af6196d663c3fd944ae9b2d9670bddf5

    • SSDEEP

      3072:6dY5qv9JuDqZzS5NdC77dDXErlkzZDQGUh2f0ES9v7tx1VXjqCafeNZeO:R4bOqZWdwyhUQGUhYWv7jzqAN

    Score
    10/10
    amadeycollectionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks