Overview

overview

10

Static

static

OOO Tochka.exe

windows7_x64

10

OOO Tochka.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OOO Tochka

  • Size

    198KB

  • Sample

    210217-xbsbsbsyks

  • MD5

    de602f032c362bdc1440d7a92874cd6f

  • SHA1

    2682a13d58b90bbeeb722e5494924f86d083ff90

  • SHA256

    b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

  • SHA512

    a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

185.215.113.17/jG3cs2rP/index.php

Targets

    • Target

      OOO Tochka

    • Size

      198KB

    • MD5

      de602f032c362bdc1440d7a92874cd6f

    • SHA1

      2682a13d58b90bbeeb722e5494924f86d083ff90

    • SHA256

      b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

    • SHA512

      a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks