Extracted

Extracted

• • Target

    5f344c80096e18a98b6acd77482886f402cfbccb90d922d03aac07d1ae6261af

  • Size

    391KB

  • MD5

    19d257c7f63ff3dbf8b5ae26f2c1b45a

  • SHA1

    dc84514dd1471efa7db9e34c43c6a60827dadad0

  • SHA256

    5f344c80096e18a98b6acd77482886f402cfbccb90d922d03aac07d1ae6261af

  • SHA512

    7cd1aa6e9c404965050e4f11bb6ec0c135332a339e734dc8a3aada0385effcda1fbea0317e02aad92a9c9d18af802538376169963fe695c11a114d17792801fb

  • SSDEEP

    6144:u59jzB1LkOHcUR1p8oOdaQ/Lgy/pmbo3uCJL0q6ZTutv7XZfDj:gxB+icUjmoOdXt/pmbStWZT8FDj

  Score

  10^/10

  amadeycollectioncredmodulespywarestealertrojanvidar1827

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

    credmodule

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2