Overview

overview

10

Static

static

620abb937a...e6.exe

windows7-x64

10

620abb937a...e6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    620abb937a0416d334115f64f47800e6.exe

  • Size

    248KB

  • Sample

    221125-jlr4xabg55

  • MD5

    620abb937a0416d334115f64f47800e6

  • SHA1

    f1021c51b93595134693137b5b5895cb2493ee49

  • SHA256

    3fc60c0a4262d3c138b685f4bbb66dc9433c06c16354c209043b4151ec62c8ea

  • SHA512

    927af2c71d434256df4445d372bd720e2bda8a1430cb8009f979a58b23fbfbcfd5e133698aa446065f8599afaf4bc04493f23c2a571298028380dbc496aceec8

  • SSDEEP

    3072:hDpLTb3wW4q1f2LTFo6JHn9D5rENA1xH0txYougIsNYDF2g/M8ZkY9fTJI1R6FLv:ppN8LJo65oaxEYrgfi/n9LJ4R69

Score
10/10
amadeypersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Targets

    • Target

      620abb937a0416d334115f64f47800e6.exe

    • Size

      248KB

    • MD5

      620abb937a0416d334115f64f47800e6

    • SHA1

      f1021c51b93595134693137b5b5895cb2493ee49

    • SHA256

      3fc60c0a4262d3c138b685f4bbb66dc9433c06c16354c209043b4151ec62c8ea

    • SHA512

      927af2c71d434256df4445d372bd720e2bda8a1430cb8009f979a58b23fbfbcfd5e133698aa446065f8599afaf4bc04493f23c2a571298028380dbc496aceec8

    • SSDEEP

      3072:hDpLTb3wW4q1f2LTFo6JHn9D5rENA1xH0txYougIsNYDF2g/M8ZkY9fTJI1R6FLv:ppN8LJo65oaxEYrgfi/n9LJ4R69

    Score
    10/10
    amadeytrojanpersistence

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks