amadey

General

Target

file.exe
Size

189KB
Sample

221109-tvsrxaacc8
MD5

37baee15b958483161bca383eac04d74
SHA1

d4556d5d33efabf07c734efe4cbec68ce5f39cb9
SHA256

6a37c10bfbb386f63bfa5e3a4894a9c24defa658a69dc3c65c5bb7a5e5c9fac7
SHA512

7feff62272fad28c9bef561ec051539c856528a9896aa42dc5b4f1fab31f2df9057ca932f8d2c170df58eb477500b4d401426f940c5da40867391ed29387abde
SSDEEP

3072:ZWyXtw4gpFOWBdeALjBQuAT/K7R6X5n7w4CG/sWZesYsf1v6uoe6:PtYpdLjBQuATBpMxJU1Auo

Score

10^/10

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  189KB
- MD5
  
  37baee15b958483161bca383eac04d74
- SHA1
  
  d4556d5d33efabf07c734efe4cbec68ce5f39cb9
- SHA256
  
  6a37c10bfbb386f63bfa5e3a4894a9c24defa658a69dc3c65c5bb7a5e5c9fac7
- SHA512
  
  7feff62272fad28c9bef561ec051539c856528a9896aa42dc5b4f1fab31f2df9057ca932f8d2c170df58eb477500b4d401426f940c5da40867391ed29387abde
- SSDEEP
  
  3072:ZWyXtw4gpFOWBdeALjBQuAT/K7R6X5n7w4CG/sWZesYsf1v6uoe6:PtYpdLjBQuATBpMxJU1Auo
Score

10^/10

smokeloader backdoor trojan amadey collection persistence spyware stealer upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2