Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17493f67e5af87c81d230613f575ad6b0a749e44668d48a46f137f8a346d9f85

  • Size

    574KB

  • Sample

    230206-mekb9sgf9t

  • MD5

    dac93748d2eb65dce6a4b7901540b770

  • SHA1

    db1fcbecd0c0efda87e6aa234c36ef89ac8841df

  • SHA256

    17493f67e5af87c81d230613f575ad6b0a749e44668d48a46f137f8a346d9f85

  • SHA512

    4da3c73af16573b3ecd75397c7662583461034fabf308cd8f20c58d04d0a170cae69c6f23ad99d44f5e521b0e90081cc01d776f56ebbb01c74ff086dc22bf2d9

  • SSDEEP

    12288:sMrry90Rfb6VVL2XsA+cw+tTznqbOzoXmmqZ+PCJ:HyGOVVSt0MOqZbJ

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      17493f67e5af87c81d230613f575ad6b0a749e44668d48a46f137f8a346d9f85

    • Size

      574KB

    • MD5

      dac93748d2eb65dce6a4b7901540b770

    • SHA1

      db1fcbecd0c0efda87e6aa234c36ef89ac8841df

    • SHA256

      17493f67e5af87c81d230613f575ad6b0a749e44668d48a46f137f8a346d9f85

    • SHA512

      4da3c73af16573b3ecd75397c7662583461034fabf308cd8f20c58d04d0a170cae69c6f23ad99d44f5e521b0e90081cc01d776f56ebbb01c74ff086dc22bf2d9

    • SSDEEP

      12288:sMrry90Rfb6VVL2XsA+cw+tTznqbOzoXmmqZ+PCJ:HyGOVVSt0MOqZbJ

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks