Extracted

Extracted

• • Target
    5f13800d4f48fdd19ba473ee83d789d3.exe
  • Size 400KB
  • SHA256 708c2a01376a80de7f93060c27fdd2e3fa12073d0b29de591704b5dc2a2d07bd
  • MD5 5f13800d4f48fdd19ba473ee83d789d3
  • SHA1 af128967e0a2c9589eee884305de62eb58b5ec94
  • SHA512 c7248ee17cc897f720fa3d829c2ab2c1a4f6eea8d54f81e61a4410a91731f09e0db177ce571d1f0abd08a4097efa45f6b60023e1be62d4765a4369ff8bcb0783
  • MD5 SHA1 SHA512

  Score

  10^/10

  vidar1448stealeramadeycollectiondiscoveryspywaresuricatatrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

    suricata

  • suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

    suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

    suricata

  • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    suricata

  • Vidar Stealer

    stealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2