File name:

001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375

Full analysis: https://app.any.run/tasks/53d6d198-56ce-4cfd-adb2-84b2e205ed08
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: March 24, 2025, 16:02:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
smoke
loader
smokeloader
redline
confuser
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

542C4EAD0D3004314149E8E75EDFCD46

SHA1:

2B7C674B2B2F6AC812A180B8E80AE7B94517685D

SHA256:

001ECE20EF94C85E55EF0A6F365B452DCA11FBEC2CAC6F2A4DF55B4C890E3375

SSDEEP:

24576:CLnTKqndI0z9pMDMKsAMLuHjswi/FX2pH9pRELkBN5JLdPooip86EPskB:CLnemI0z9pMDMKsAMLuHjswi/FX2pdpz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • saves.exe (PID: 5956)
    • Connects to the CnC server

      • saves.exe (PID: 5956)
    • AMADEY mutex has been found

      • saves.exe (PID: 4424)
      • saves.exe (PID: 4268)
    • AMADEY has been detected (YARA)

      • saves.exe (PID: 5956)
    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 5492)
    • SMOKE mutex has been found

      • explorer.exe (PID: 5492)
    • REDLINE has been detected (YARA)

      • d5731805.exe (PID: 3900)
    • Runs injected code in another process

      • c2452410.exe (PID: 4944)
    • Application was injected by another process

      • explorer.exe (PID: 5492)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe (PID: 4688)
    • Starts a Microsoft application from unusual location

      • 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe (PID: 4688)
      • v3099591.exe (PID: 5024)
      • v9232368.exe (PID: 1628)
      • v5307313.exe (PID: 1052)
    • Executable content was dropped or overwritten

      • 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe (PID: 4688)
      • v3099591.exe (PID: 5024)
      • v9232368.exe (PID: 1628)
      • b1350157.exe (PID: 1020)
      • v5307313.exe (PID: 1052)
    • Reads security settings of Internet Explorer

      • b1350157.exe (PID: 1020)
      • saves.exe (PID: 5956)
    • Connects to the server without a host name

      • saves.exe (PID: 5956)
      • explorer.exe (PID: 5492)
    • Starts itself from another location

      • b1350157.exe (PID: 1020)
    • Contacting a server suspected of hosting an CnC

      • saves.exe (PID: 5956)
    • Connects to unusual port

      • d5731805.exe (PID: 3900)
    • The process executes via Task Scheduler

      • saves.exe (PID: 4424)
      • saves.exe (PID: 4268)
    • Process requests binary or script from the Internet

      • saves.exe (PID: 5956)
  • INFO

    • The sample compiled with english language support

      • 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe (PID: 4688)
    • Create files in a temporary directory

      • 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe (PID: 4688)
      • v3099591.exe (PID: 5024)
      • v9232368.exe (PID: 1628)
      • b1350157.exe (PID: 1020)
      • v5307313.exe (PID: 1052)
    • Checks supported languages

      • 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe (PID: 4688)
      • v3099591.exe (PID: 5024)
      • v9232368.exe (PID: 1628)
      • b1350157.exe (PID: 1020)
      • v5307313.exe (PID: 1052)
      • a6239898.exe (PID: 4724)
      • saves.exe (PID: 4424)
      • d5731805.exe (PID: 3900)
      • saves.exe (PID: 4268)
    • Reads the computer name

      • b1350157.exe (PID: 1020)
      • a6239898.exe (PID: 4724)
      • d5731805.exe (PID: 3900)
    • Process checks computer location settings

      • b1350157.exe (PID: 1020)
    • Reads the machine GUID from the registry

      • d5731805.exe (PID: 3900)
      • saves.exe (PID: 5956)
    • Confuser has been detected (YARA)

      • d5731805.exe (PID: 3900)
    • Checks proxy server information

      • slui.exe (PID: 3268)
      • explorer.exe (PID: 5492)
    • Reads the software policy settings

      • slui.exe (PID: 3268)
      • saves.exe (PID: 5956)
    • Creates files or folders in the user directory

      • saves.exe (PID: 5956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(5956) saves.exe
C277.91.68.18
URLhttp://77.91.68.18/nice/index.php
Version3.87
Options
Drop directoryb40d11255d
Drop namesaves.exe
Strings (124)ps1
------
.jpg
:R" /E
rundll32.exe
GET
&os=
<c>
b40d11255d
WinDefender
&&
wb
Norton
ProgramData\
rundll32
Powershell.exe
/k
id=
kernel32.dll
Sophos
POST
cred.dll|clip.dll|
&vs=
#
Bitdefender
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
2019
Kaspersky Lab
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
Content-Type: multipart/form-data; boundary=----
&sd=
SCHTASKS
+++
Startup
e0
Avira
ESET
echo Y|CACLS "
" && ren
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
&&
&dm=
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
/Create /SC MINUTE /MO 1 /TN
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
&av=
77.91.68.18
/TR "
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
AVG
&ar=
DefaultSettings.YResolution
&unit=
&bi=
AVAST Software
exe
http://
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
-unicode-
" /P "
-executionpolicy remotesigned -File "
ComputerName
saves.exe
:F" /E
2022
&og=
..\
--
\
&&Exit
d1
S-%lu-
/Delete /TN "
" Content-Type: application/octet-stream
%-lu
Plugins/
" /F
GetNativeSystemInfo
&& Exit"
CACLS "
Content-Type: application/x-www-form-urlencoded
:N"
/nice/index.php
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
Rem
&pc=
\App
2016
"
cmd
&un=
3.87
-%lu
DefaultSettings.XResolution
&lv=
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 713216
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
13
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe v3099591.exe v9232368.exe v5307313.exe a6239898.exe no specs b1350157.exe #AMADEY saves.exe c2452410.exe no specs #REDLINE d5731805.exe #SMOKE explorer.exe saves.exe no specs slui.exe saves.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1020C:\Users\admin\AppData\Local\Temp\IXP003.TMP\b1350157.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\b1350157.exe
v5307313.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\b1350157.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1052C:\Users\admin\AppData\Local\Temp\IXP002.TMP\v5307313.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\v5307313.exe
v9232368.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\v5307313.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1628C:\Users\admin\AppData\Local\Temp\IXP001.TMP\v9232368.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\v9232368.exe
v3099591.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\v9232368.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3268C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3900C:\Users\admin\AppData\Local\Temp\IXP001.TMP\d5731805.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\d5731805.exe
v3099591.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nirtro CPU
Version:
15.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\d5731805.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4268"C:\Users\admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\admin\AppData\Local\Temp\b40d11255d\saves.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b40d11255d\saves.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4424"C:\Users\admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\admin\AppData\Local\Temp\b40d11255d\saves.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b40d11255d\saves.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4688"C:\Users\admin\Desktop\001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe" C:\Users\admin\Desktop\001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4724C:\Users\admin\AppData\Local\Temp\IXP003.TMP\a6239898.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\a6239898.exev5307313.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\a6239898.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4944C:\Users\admin\AppData\Local\Temp\IXP002.TMP\c2452410.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\c2452410.exev9232368.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
8 713
Read events
8 713
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\v3099591.exeexecutable
MD5:AA6844E362DDF97043D736910C1018C1
SHA256:8E7FB9E21DB7A8AC32F25BF8067532765762868A7192419F4C90EB1C97916A30
1628v9232368.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\v5307313.exeexecutable
MD5:223F25EDE2EF46BC0B51E2C156CD498D
SHA256:F119D4960E3701F2BBE7ED87EAE7A8B1C466063D917BC757B25334F7E87880EC
1628v9232368.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\c2452410.exeexecutable
MD5:1A048F1FF412C57789EECAC14C81C9DD
SHA256:74760F39B60DBF83C23FE034168D9F6D6AB3FEB6CB10EBCC9389147DD25E5A8A
1052v5307313.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\b1350157.exeexecutable
MD5:2646194C5FA0F891AFE999AF5ECED480
SHA256:6975133057D5A72215D74415C73CC23AA54A34A1D91FC084B3F6F4EA254CD3A3
4688001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\e4787036.exeexecutable
MD5:05DFE6651E58860FD4C8E68573CB76E9
SHA256:1C2032726166516DDB6EA4B040C636ED119064E4D6C7E7CB8D5985A28B3D0EDC
5956saves.exeC:\Users\admin\AppData\Roaming\006700e5a2ab05\clip64.dlltext
MD5:595E88012A6521AAE3E12CBEBE76EB9E
SHA256:B16E15764B8BC06C5C3F9F19BC8B99FA48E7894AA5A6CCDAD65DA49BBF564793
5024v3099591.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\v9232368.exeexecutable
MD5:D867FEF685BDA8A20420EFD9164AC2A8
SHA256:33E6D5E25E1D64DD2136403D679B9FBC4C1B4B92F821ACDB3DBB0882F912C116
5956saves.exeC:\Users\admin\AppData\Roaming\006700e5a2ab05\cred64.dlltext
MD5:595E88012A6521AAE3E12CBEBE76EB9E
SHA256:B16E15764B8BC06C5C3F9F19BC8B99FA48E7894AA5A6CCDAD65DA49BBF564793
1020b1350157.exeC:\Users\admin\AppData\Local\Temp\b40d11255d\saves.exeexecutable
MD5:2646194C5FA0F891AFE999AF5ECED480
SHA256:6975133057D5A72215D74415C73CC23AA54A34A1D91FC084B3F6F4EA254CD3A3
1052v5307313.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\a6239898.exeexecutable
MD5:7E93BACBBC33E6652E147E7FE07572A0
SHA256:850CD190AAEEBCF1505674D97F51756F325E650320EAF76785D954223A9BEE38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
5
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5956
saves.exe
POST
405
77.91.68.18:80
http://77.91.68.18/nice/index.php
unknown
malicious
5492
explorer.exe
POST
77.91.68.29:80
http://77.91.68.29/fks/
unknown
malicious
5956
saves.exe
GET
302
77.91.68.18:80
http://77.91.68.18/nice/Plugins/clip64.dll
unknown
malicious
5492
explorer.exe
POST
77.91.68.29:80
http://77.91.68.29/fks/
unknown
malicious
5956
saves.exe
GET
302
77.91.68.18:80
http://77.91.68.18/nice/Plugins/cred64.dll
unknown
malicious
GET
404
77.91.68.18:443
https://static.18.68.91.77.ip.webhost1.net/nice/Plugins/cred64.dll
unknown
text
19 b
GET
404
77.91.68.18:443
https://static.18.68.91.77.ip.webhost1.net/nice/Plugins/clip64.dll
unknown
text
19 b
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
5956
saves.exe
77.91.68.18:80
static.18.68.91.77.ip.webhost1.net
Foton Telecom CJSC
RU
malicious
3900
d5731805.exe
77.91.124.54:19071
Foton Telecom CJSC
RU
malicious
5492
explorer.exe
77.91.68.29:80
Foton Telecom CJSC
RU
malicious
5956
saves.exe
77.91.68.18:443
static.18.68.91.77.ip.webhost1.net
Foton Telecom CJSC
RU
malicious
2284
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3268
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.142
whitelisted
static.18.68.91.77.ip.webhost1.net
  • 77.91.68.18
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
5956
saves.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
5956
saves.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
5956
saves.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
3900
d5731805.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
5492
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
5492
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
5956
saves.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
5956
saves.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Stealer plugin download request
5956
saves.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
5956
saves.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Clipper plugin download request
No debug info