Description
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
General
Target
Size
Sample
920872b6c2b2f2c535729538c8359f8a8456399dbe6eec8cf52389e16c1458d3.exe
321KB
220523-b8rsnaehbn
Score
10/10
MD5
SHA1
SHA256
SHA512
198929adc74b1ba1e260c2b614e1ed80
2bc01b272b38257f357104ae6c2a7e70e59aabce
920872b6c2b2f2c535729538c8359f8a8456399dbe6eec8cf52389e16c1458d3
094e75cf694278231c479d556dd48d6cf19ba6dad4569cf701914fc3f671253881e20d787adad555820d05be3c922279befea23100f7718452d35d05239b4cff
Malware Config
Extracted
| Family | amadey |
| Version | 3.08 |
| C2 |
185.215.113.35/d2VxjasuwS/index.php |
Targets
Target
MD5
Filesize
920872b6c2b2f2c535729538c8359f8a8456399dbe6eec8cf52389e16c1458d3.exe
198929adc74b1ba1e260c2b614e1ed80
321KB
Score
10/10
SHA1
SHA256
SHA512
2bc01b272b38257f357104ae6c2a7e70e59aabce
920872b6c2b2f2c535729538c8359f8a8456399dbe6eec8cf52389e16c1458d3
094e75cf694278231c479d556dd48d6cf19ba6dad4569cf701914fc3f671253881e20d787adad555820d05be3c922279befea23100f7718452d35d05239b4cff
Tags
Signatures
-
Amadey
-
suricata: ET MALWARE Amadey CnC Check-In
Description
suricata: ET MALWARE Amadey CnC Check-In
Tags
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Loads dropped DLL
-
Reads local data of messenger clients
Description
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
Tags
TTPs
-
Accesses Microsoft Outlook profiles
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Detected potential entity reuse from brand microsoft.
Tags
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10