Overview

overview

10

Static

static

ebf15c6db0...8f.exe

windows7_x64

10

ebf15c6db0...8f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ebf15c6db0a62d32a2a15a8f13e1c88f
  • Size 214KB
  • Sample210829-6p1dev7wnn
  • SHA256 db148eccfdeedddeca41eb2ac092db09e6c568b714e5f2d9b2560bf5b2551952
  • MD5 SHA1 SHA512
Score
10/10
amadeysuricatatrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 2.50

C2

  • 185.215.113.206/k8FppT/index.php

Targets

    • Target
      ebf15c6db0a62d32a2a15a8f13e1c88f
    • Size 214KB
    • SHA256 db148eccfdeedddeca41eb2ac092db09e6c568b714e5f2d9b2560bf5b2551952
    • MD5 SHA1 SHA512
    Score
    10/10
    amadeysuricatatrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • suricata: ET MALWARE Amadey CnC Check-In

      suricata: ET MALWARE Amadey CnC Check-In

      suricata

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks