Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54936d3e797ed7b4649357d91b20b2234f72277e887d10be96ae760882373434

  • Size

    585KB

  • Sample

    230206-nakmxagh6v

  • MD5

    adc35fc2df48c38ded312e80c9d52db3

  • SHA1

    cd123c75b7feb17c03ff0480374dccff98229bf1

  • SHA256

    54936d3e797ed7b4649357d91b20b2234f72277e887d10be96ae760882373434

  • SHA512

    9473652591be8013024dd51381fc51188d97322bf60e3a104bfe0d42383a605f1ee734bed718331ec1f793cc640ea1965286694b3cd22d8afaf795bcf731da21

  • SSDEEP

    12288:5Mrty90zywJxjPM5P0RHGoQ+NE9AyDPiiI8WXuBgSbio:ky7wJxjA8RHOgE9Akij8BgSb

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      54936d3e797ed7b4649357d91b20b2234f72277e887d10be96ae760882373434

    • Size

      585KB

    • MD5

      adc35fc2df48c38ded312e80c9d52db3

    • SHA1

      cd123c75b7feb17c03ff0480374dccff98229bf1

    • SHA256

      54936d3e797ed7b4649357d91b20b2234f72277e887d10be96ae760882373434

    • SHA512

      9473652591be8013024dd51381fc51188d97322bf60e3a104bfe0d42383a605f1ee734bed718331ec1f793cc640ea1965286694b3cd22d8afaf795bcf731da21

    • SSDEEP

      12288:5Mrty90zywJxjPM5P0RHGoQ+NE9AyDPiiI8WXuBgSbio:ky7wJxjA8RHOgE9Akij8BgSb

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks