Overview

overview

10

Static

static

2d495c79c5...ea.exe

windows7_x64

10

2d495c79c5...ea.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe
  • Size 261KB
  • Sample210718-p4ny14dv3e
  • SHA256 2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea3883882b257ab4263f3
  • MD5 SHA1 SHA512
Score
10/10
amadeypersistencetrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 2.41

C2

  • ama529.ru/gBcskbwWs/index.php

  • amaad100.com/gBcskbwWs/index.php

  • 900ama.com/gBcskbwWs/index.php

Targets

    • Target
      2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe
    • Size 261KB
    • SHA256 2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea3883882b257ab4263f3
    • MD5 SHA1 SHA512
    Score
    10/10
    amadeypersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks