General

  • Target

    27dd4c9681286556c9f766d89dc98d7161090cce591362034b2a33f1e83fc3e1

  • Size

    558KB

  • Sample

    230206-zgdnqaba8z

  • MD5

    47d9fa8f9686171903b2e11dec2ff19a

  • SHA1

    8c86ceb449b95f4249985ea13441069f88f04f1b

  • SHA256

    27dd4c9681286556c9f766d89dc98d7161090cce591362034b2a33f1e83fc3e1

  • SHA512

    9b5fde16e1c035ffd7a23ab1cc1ace3fea33ae2a68d148bffdcb6111279a3361b9645d9eff711af3f0dbcb0c1dd3c16d3a3aefc1b857262d35c3361148afb95f

  • SSDEEP

    12288:jMrEy90ZkuWS3ZNTF1ePmmcWsF+kMaTOmNR0qbfkurEU9Rj+v:DykMyTFMyHTOmNR0qbTrEU9ov

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      27dd4c9681286556c9f766d89dc98d7161090cce591362034b2a33f1e83fc3e1

    • Size

      558KB

    • MD5

      47d9fa8f9686171903b2e11dec2ff19a

    • SHA1

      8c86ceb449b95f4249985ea13441069f88f04f1b

    • SHA256

      27dd4c9681286556c9f766d89dc98d7161090cce591362034b2a33f1e83fc3e1

    • SHA512

      9b5fde16e1c035ffd7a23ab1cc1ace3fea33ae2a68d148bffdcb6111279a3361b9645d9eff711af3f0dbcb0c1dd3c16d3a3aefc1b857262d35c3361148afb95f

    • SSDEEP

      12288:jMrEy90ZkuWS3ZNTF1ePmmcWsF+kMaTOmNR0qbfkurEU9Rj+v:DykMyTFMyHTOmNR0qbTrEU9ov

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Discovery

System Information Discovery

1
T1082

Tasks