Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd219b87301e35f3a543b247ba7c8778e6c3470e00ac9ef40363380493a71609

  • Size

    574KB

  • Sample

    230206-mjhz1add98

  • MD5

    72f0e0e8628366accfba7c68fbbee952

  • SHA1

    05d1e193b9bb522c12b651ca09c6e596a6835111

  • SHA256

    fd219b87301e35f3a543b247ba7c8778e6c3470e00ac9ef40363380493a71609

  • SHA512

    161f72b4270b3a85877f3a85c269220506b6ecc27e65124177c69651387fc92a78ee13f06df3f00f8f7cb6db198f148b84558f8bd982a8e327bae05eed8ca8e8

  • SSDEEP

    12288:EMrPy904K99VMCoF5ci7rMbo+tTzn6bOLoTmxTGoe:zybKLV2FZ7retkkpFe

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      fd219b87301e35f3a543b247ba7c8778e6c3470e00ac9ef40363380493a71609

    • Size

      574KB

    • MD5

      72f0e0e8628366accfba7c68fbbee952

    • SHA1

      05d1e193b9bb522c12b651ca09c6e596a6835111

    • SHA256

      fd219b87301e35f3a543b247ba7c8778e6c3470e00ac9ef40363380493a71609

    • SHA512

      161f72b4270b3a85877f3a85c269220506b6ecc27e65124177c69651387fc92a78ee13f06df3f00f8f7cb6db198f148b84558f8bd982a8e327bae05eed8ca8e8

    • SSDEEP

      12288:EMrPy904K99VMCoF5ci7rMbo+tTzn6bOLoTmxTGoe:zybKLV2FZ7retkkpFe

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks