File name:

splwow64.exe

Full analysis: https://app.any.run/tasks/264bda92-63de-45bd-9dbf-405326e5b3d7
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: September 23, 2024, 20:10:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
metastealer
redline
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2B01C9B0C69F13DA5EE7889A4B17C45E

SHA1:

27F0C1AE0DDEDDC9EFAC38BC473476B103FEF043

SHA256:

D5526528363CEEB718D30BC669038759C4CD80A1D3E9C8C661B12B261DCC9E29

SSDEEP:

49152:xbJ5NYRgPOau6akedLowwEoE62lde2gje64fzvlTgR/LLiWaBWoKpl7mXLLiA6+0:xbJ5MgdZakcA1E6Gc7jgfcZaLM7mHiTh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • Waters.pif (PID: 6184)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 736)
    • Connects to the CnC server

      • Waters.pif (PID: 6184)
      • ZusYB3MdCO.exe (PID: 6384)
    • REDLINE has been detected (SURICATA)

      • ZusYB3MdCO.exe (PID: 6384)
    • Stealers network behavior

      • Aw9ir134T1.exe (PID: 5160)
      • ZusYB3MdCO.exe (PID: 6384)
    • METASTEALER has been detected (SURICATA)

      • ZusYB3MdCO.exe (PID: 6384)
      • Aw9ir134T1.exe (PID: 5160)
    • REDLINE has been detected (YARA)

      • ZusYB3MdCO.exe (PID: 6384)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 4476)
    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2892)
      • splwow64.exe (PID: 4476)
    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2892)
      • Waters.pif (PID: 6184)
      • RegAsm.exe (PID: 6352)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2892)
    • Application launched itself

      • cmd.exe (PID: 2892)
    • Starts application with an unusual extension

      • cmd.exe (PID: 2892)
      • wscript.exe (PID: 4520)
    • Executing commands from a ".bat" file

      • splwow64.exe (PID: 4476)
    • Get information on the list of running processes

      • cmd.exe (PID: 2892)
    • The executable file from the user directory is run by the CMD process

      • Waters.pif (PID: 6184)
    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2892)
    • Contacting a server suspected of hosting an CnC

      • Waters.pif (PID: 6184)
      • Aw9ir134T1.exe (PID: 5160)
    • Connects to unusual port

      • ZusYB3MdCO.exe (PID: 6384)
      • Aw9ir134T1.exe (PID: 5160)
    • Potential Corporate Privacy Violation

      • Waters.pif (PID: 6184)
    • The process executes via Task Scheduler

      • wscript.exe (PID: 4520)
  • INFO

    • The process uses the downloaded file

      • splwow64.exe (PID: 4476)
    • Create files in a temporary directory

      • splwow64.exe (PID: 4476)
    • Checks supported languages

      • splwow64.exe (PID: 4476)
    • Reads the computer name

      • splwow64.exe (PID: 4476)
    • Process checks computer location settings

      • splwow64.exe (PID: 4476)
    • Manual execution by a user

      • cmd.exe (PID: 736)
      • cmd.exe (PID: 6680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(6384) ZusYB3MdCO.exe
C2 (1)65.21.18.51:45580
Botnet@LOGSCLOUDYT_BOT
Options
ErrorMessage
Keys
XorBackswords
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28672
InitializedDataSize: 4120064
UninitializedDataSize: 16896
EntryPoint: 0x3899
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 10.0.22621.3672
ProductVersionNumber: 10.0.22621.3672
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Print driver host for applications
FileVersion: 10.0.22621.3672 (WinBuild.160101.0800)
InternalName: splwow64.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: splwow64.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.22621.3672
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
27
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start splwow64.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #AMADEY waters.pif choice.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs 12dsvc.exe no specs conhost.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe #METASTEALER aw9ir134t1.exe conhost.exe no specs #REDLINE zusyb3mdco.exe wscript.exe no specs quantumflow.scr no specs

Process information

PID
CMD
Path
Indicators
Parent process
376\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\cmd.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
740tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1048schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1076cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeAw9ir134T1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2892"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.batC:\Windows\SysWOW64\cmd.exe
splwow64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3140findstr /I "wrsa opssvc" C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3324"C:\Users\admin\AppData\Local\Temp\1000434001\12dsvc.exe" C:\Users\admin\AppData\Local\Temp\1000434001\12dsvc.exeWaters.pif
User:
admin
Company:
Production subsumption
Integrity Level:
MEDIUM
Description:
protestations wonk separationist
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1000434001\12dsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe12dsvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 550
Read events
10 546
Write events
4
Delete events
0

Modification events

(PID) Process:(6184) Waters.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6184) Waters.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6184) Waters.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4520) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
6F88230000000000
Executable files
6
Suspicious files
18
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Streamingbinary
MD5:1501DE696D22F872DB44B548CBA0E4FA
SHA256:DCF4784EA71A3E1A42318C09183D4B5981009D296814D3679CA68EB0A7C9E2EF
2892cmd.exeC:\Users\admin\AppData\Local\Temp\Emotions.battext
MD5:B98D78C3ABE777A5474A60E970A674AD
SHA256:2BC28AFB291ECE550A7CD2D0C5C060730EB1981D1CF122558D6971526C637EB4
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Emotionstext
MD5:B98D78C3ABE777A5474A60E970A674AD
SHA256:2BC28AFB291ECE550A7CD2D0C5C060730EB1981D1CF122558D6971526C637EB4
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Languagebinary
MD5:5DE7106DF85E2F96F46F642D98433AD1
SHA256:9201319C9C07E4312717845E59C9FE3A987F70575CD63E4C042DB778EBE4D5E9
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Betbinary
MD5:0F3F07B667E947C4DA38813D6D651E2A
SHA256:32B3D9D5BC58659EA524AA2CABD9CFC81B73E679E3D2CC899DFB00439612F5FF
1076cmd.exeC:\Users\admin\AppData\Local\Temp\607698\Qbinary
MD5:7B5632DCD418BCBAE2A9009DBAF85F37
SHA256:361E9C3B62719B79BC280420B5F710E160FD55F2250BF605911DED7162483DB4
6184Waters.pifC:\Users\admin\AppData\Local\QuantumDynamics Lab\Wbinary
MD5:7B5632DCD418BCBAE2A9009DBAF85F37
SHA256:361E9C3B62719B79BC280420B5F710E160FD55F2250BF605911DED7162483DB4
6184Waters.pifC:\Users\admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.jstext
MD5:CA21689FE68A876F068F8A87A906FE9A
SHA256:E0DD98EA1A93E08F544D822A56336CBD422564AF81A5759C4759430E2B055A12
2892cmd.exeC:\Users\admin\AppData\Local\Temp\607698\Waters.pifexecutable
MD5:71E28D40E99E3136459D1A310748A687
SHA256:141E3E9EDF7943E768B146BA6AB8B4A6A79F162B5054EF9AFA0D11E236DB07E1
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Ensuresbinary
MD5:C6FA82D60CFBF9E83B4CF3CBD1F01552
SHA256:2686B284D1C21D06AB10829C16657334E13428210CCDA89F68BFB8ACBFC72B42
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
42
DNS requests
16
Threats
41

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
936
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
2340
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
2340
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6184
Waters.pif
POST
200
185.215.113.19:80
http://185.215.113.19/CoreOPT/index.php
unknown
unknown
6184
Waters.pif
POST
200
185.215.113.19:80
http://185.215.113.19/CoreOPT/index.php
unknown
unknown
6184
Waters.pif
GET
200
194.116.215.195:80
http://194.116.215.195/12dsvc.exe
unknown
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
52.167.17.97:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
whitelisted
936
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
936
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
20.189.173.7:443
browser.pipe.aria.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5336
SearchApp.exe
2.23.209.143:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.167.17.97
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 88.221.169.152
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
HAYtAoQHDCIZfrnmkrkib.HAYtAoQHDCIZfrnmkrkib
unknown
browser.pipe.aria.microsoft.com
  • 20.189.173.7
whitelisted
www.bing.com
  • 2.23.209.143
  • 2.23.209.150
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.183
  • 2.23.209.135
  • 2.23.209.154
  • 2.23.209.189
  • 2.23.209.133
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
6184
Waters.pif
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6184
Waters.pif
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST) M1
6184
Waters.pif
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6184
Waters.pif
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST)
6184
Waters.pif
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6184
Waters.pif
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6184
Waters.pif
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6184
Waters.pif
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
5160
Aw9ir134T1.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] MetaStealer v.5 (MC-NMF TLS Server Certificate)
5160
Aw9ir134T1.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] MetaStealer v.5 TLS Certificate
2 ETPRO signatures available at the full report
No debug info