Overview

overview

10

Static

static

1afd1322dc...45.exe

windows7_x64

10

1afd1322dc...45.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1afd1322dc9b3c3c3a952da37cdfa645
  • Size 210KB
  • Sample210717-13szf6mspn
  • SHA256 884a1949638e54c76eb0ee548d3a23b4ecf29aba47408564d379fb2dc6cdef92
  • MD5 SHA1 SHA512
Score
10/10
amadeysmokeloaderbackdoortrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://custom100.ru/

  • http://other191.com/

  • http://custom300.com/

  • http://600other.com/

rc4.i32
rc4.i32

Extracted

Family

  • amadey

Version

  • 2.41

C2

  • ama529.ru/gBcskbwWs/index.php

  • amaad100.com/gBcskbwWs/index.php

  • 900ama.com/gBcskbwWs/index.php

Targets

    • Target
      1afd1322dc9b3c3c3a952da37cdfa645
    • Size 210KB
    • SHA256 884a1949638e54c76eb0ee548d3a23b4ecf29aba47408564d379fb2dc6cdef92
    • MD5 SHA1 SHA512
    Score
    10/10
    amadeysmokeloaderbackdoortrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks