amadey | a01d6a1c4b087af2410a3be78134fcff02bf52a2829eacdda7204d2b648ac532

General

Target
2026-10-14_3a06111672518dd528d0499a2dfc3959_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.6MB
Sample261014-3ehrfacw21
SHA256 a01d6a1c4b087af2410a3be78134fcff02bf52a2829eacdda7204d2b648ac532
MD5 3a06111672518dd528d0499a2dfc3959
SHA1 ea3e70cbd24d39275f096d81a9ce82ca35f87616
SHA512 e6ec249ea9c34a740f56e1f7a4ba34b56255ce5bf4bd7501f715d938ea046135f80414aaa7052bbafd9ffa5490e4774473175c5ed4569b8ff37af3c0ea0f13c6
SSDEEP 49152:L3/abteTSWsMDknMmZywnMmZyHc9EBjlQp9Pw+pIsQQ:atqS86tdtaYEYPvXQQ
TLSH
T1DD261C8DB36C01A9C142447620F10A92E7B9EB1693E85A475BC6CC748F121DDBFBDAF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

5.80

Botnet

282234

C2

http://196.251.107.104
http://196.251.107.130

Attributes

install_file
jusched.exe
strings_key
2b027217c3165b773ce9c5d19866b021
url_paths
/Psd8eZaW/index.php

/h84jjfAr/index.php

rc4.hex

Targets

- Target
  2026-10-14_3a06111672518dd528d0499a2dfc3959_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 4.6MB
- SHA256 a01d6a1c4b087af2410a3be78134fcff02bf52a2829eacdda7204d2b648ac532
- MD5 3a06111672518dd528d0499a2dfc3959
- SHA1 ea3e70cbd24d39275f096d81a9ce82ca35f87616
- SHA512 e6ec249ea9c34a740f56e1f7a4ba34b56255ce5bf4bd7501f715d938ea046135f80414aaa7052bbafd9ffa5490e4774473175c5ed4569b8ff37af3c0ea0f13c6
- SSDEEP 49152:L3/abteTSWsMDknMmZywnMmZyHc9EBjlQp9Pw+pIsQQ:atqS86tdtaYEYPvXQQ
- TLSH
  T1DD261C8DB36C01A9C142447620F10A92E7B9EB1693E85A475BC6CC748F121DDBFBDAF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

282234 discovery amadey stealc stealer trojan
- Detects Stealc stealer Version 3
- Family: Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Detects Reflective DLL injection artifacts
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Stealc stealer Version 3

Family: Amadey

Family: Stealc

Detects Reflective DLL injection artifacts

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2