Overview

overview

10

Static

static

10

cred64.dll

windows10-ltsc 2021-x64

8

cred64.dll

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    cred64.dll
  • Size 1.2MB
  • Sample250308-ryggyaymw6
  • SHA256 080ea1d225c77364abb02fbb1b65e9693654242ecc5c91f34c531ecf363a2f4c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadey652098credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • amadey

Version

  • 5.30

Botnet

  • 652098

C2

  • http://185.125.50.8

Attributes
  • strings_key

    bfbda6ae1db325c2ff4b455ce9896e6d

  • url_paths

    /mVsXkjvb3/index.php

rc4.plain

Targets

    • Target
      cred64.dll
    • Size 1.2MB
    • SHA256 080ea1d225c77364abb02fbb1b65e9693654242ecc5c91f34c531ecf363a2f4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Blocklisted process makes network request

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks