General

  • Target

    c2f2b7b2e0ed37ed715104e1408d210cb6207db6b26068abd2c0398e30305486

  • Size

    558KB

  • Sample

    230206-x125bafd95

  • MD5

    130c0246aa4a7d699e7b54b1f32d0d9b

  • SHA1

    2c40cee6c903aeadda1537e05afc2d7df66652c2

  • SHA256

    c2f2b7b2e0ed37ed715104e1408d210cb6207db6b26068abd2c0398e30305486

  • SHA512

    55f2d1f943300f6b1bff155c8591c09000a8b170411cbf657fa1f22556e187a032c2a73c5cccf08dfba497fd951ccd98a94dbc6e65583adec5f910f4ab24efb3

  • SSDEEP

    12288:SMrNy90WUdDgkS9cFloCKwccDUK6uYCv8TM53VpaNj+bVLKliPK6xslRTi:vyRQDJlolwceDHv87yQ6xslRTi

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

Targets

    • Target

      c2f2b7b2e0ed37ed715104e1408d210cb6207db6b26068abd2c0398e30305486

    • Size

      558KB

    • MD5

      130c0246aa4a7d699e7b54b1f32d0d9b

    • SHA1

      2c40cee6c903aeadda1537e05afc2d7df66652c2

    • SHA256

      c2f2b7b2e0ed37ed715104e1408d210cb6207db6b26068abd2c0398e30305486

    • SHA512

      55f2d1f943300f6b1bff155c8591c09000a8b170411cbf657fa1f22556e187a032c2a73c5cccf08dfba497fd951ccd98a94dbc6e65583adec5f910f4ab24efb3

    • SSDEEP

      12288:SMrNy90WUdDgkS9cFloCKwccDUK6uYCv8TM53VpaNj+bVLKliPK6xslRTi:vyRQDJlolwceDHv87yQ6xslRTi

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks