General

  • Target

    2025-03-29_fdd55ad9190ca9a56c0d400d65b7504f_amadey_smoke-loader

  • Size

    240KB

  • Sample

    250329-wk361awk14

  • MD5

    fdd55ad9190ca9a56c0d400d65b7504f

  • SHA1

    cd2e1d9636fa035ec3c739a478b9f92bf3b52727

  • SHA256

    79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487

  • SHA512

    bea47ea7099e6922ffa60442e3f7010fdffa86e37a020e2fc30502b42a76ad5fbfd9780af988742b398fb9487744d4095912183157aa89ae40f31492b76e95cb

  • SSDEEP

    3072:s0JdEu+qhhl0lPWxkWOCVY/OvMEcMA0bgzdiDp2uU7ef9aoACaNRCHeP3KqX+n:EutRjxk0dcMlIkN2uff3ACGCot+

Malware Config

Targets

    • Target

      2025-03-29_fdd55ad9190ca9a56c0d400d65b7504f_amadey_smoke-loader

    • Size

      240KB

    • MD5

      fdd55ad9190ca9a56c0d400d65b7504f

    • SHA1

      cd2e1d9636fa035ec3c739a478b9f92bf3b52727

    • SHA256

      79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487

    • SHA512

      bea47ea7099e6922ffa60442e3f7010fdffa86e37a020e2fc30502b42a76ad5fbfd9780af988742b398fb9487744d4095912183157aa89ae40f31492b76e95cb

    • SSDEEP

      3072:s0JdEu+qhhl0lPWxkWOCVY/OvMEcMA0bgzdiDp2uU7ef9aoACaNRCHeP3KqX+n:EutRjxk0dcMlIkN2uff3ACGCot+

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks