Overview

overview

10

Static

static

3

f4bdddb45e...13.exe

windows7-x64

10

f4bdddb45e...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4bdddb45e727c8699340ba8d520a37e07b0becb4c571a67b3c9f4ce3a138213.zip

  • Size

    293KB

  • Sample

    231119-3vbytsdf2t

  • MD5

    50dd38093752d54e071569b739c17efd

  • SHA1

    e6ea124b09907847f0cf8b5c0baf84c72b935ed1

  • SHA256

    72b1ac6cad4d6173e3ef9a8b65b76298f1b9c9f7a197928d219fcbad64c87845

  • SHA512

    12f4664b2c6a6f6552c94a4f226be57251b230978d72699087417f7d722c333079ad93a7b117bb0a767f83380bf3fbbcc9da6336610ec59006c8db617f508f6b

  • SSDEEP

    6144:WS0mm0HGlrgtU31GjBx/LqMvu6S9f5vIrhG8tBzUK7An/gxW6zl+19KdyFqOD:WS0m3eMtU3AjBxWMv5S9fOrhdBYEAniY

Score
10/10
amadeyspywarestealertrojan

Malware Config

Targets

    • Target

      f4bdddb45e727c8699340ba8d520a37e07b0becb4c571a67b3c9f4ce3a138213.exe

    • Size

      393KB

    • MD5

      f46f73d5fa369883f2f0f7f1da7c646f

    • SHA1

      3d32694d4f2ab002fda7610117ea3e14fbe983ed

    • SHA256

      f4bdddb45e727c8699340ba8d520a37e07b0becb4c571a67b3c9f4ce3a138213

    • SHA512

      836fed4872fd5e08fe814f538dbc55e70c378297ef585dcc7bc763223300a6edd42d7671deb9844a010c195e784f30a9d2eea93acf4ca76df6f811e75e40fa1a

    • SSDEEP

      6144:WKNLSD2LqJGz0ZAdH2r/di2Pwd2olDDdpfM4Z:9WDumABC/Nwd2opdp

    Score
    10/10
    amadeyspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks