Triage | Malware sandboxing report by Hatching Triage

Sharing

General

Target

298326b2b9dc71aa7d21fd69f1192fbda1a1003ef9eb92dec9300cbbc2227bba
Size

558KB
Sample

230206-zlbpxsfg97
MD5

b97c7b6b4b82275fc48e1dfb87fdbd69
SHA1

8426893365692a41a93cabdbf74a05cb0b467cb1
SHA256

298326b2b9dc71aa7d21fd69f1192fbda1a1003ef9eb92dec9300cbbc2227bba
SHA512

2809c598bb8c6d4396a7ab520fd5f0049c90905d71bd71ac84d13508b8acdb4fccda95a55cbe9ebae5589b631a7f9b876284edbd09daf092fa5b76da5b2a3641
SSDEEP

12288:0MrKy90QQM95Op+uF1QzCsF+gMaTymNR8ofTb+E:uyZFuFWHTymNR8oLbx

Score

10^/10

amadey evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

- Target
  
  298326b2b9dc71aa7d21fd69f1192fbda1a1003ef9eb92dec9300cbbc2227bba
- Size
  
  558KB
- MD5
  
  b97c7b6b4b82275fc48e1dfb87fdbd69
- SHA1
  
  8426893365692a41a93cabdbf74a05cb0b467cb1
- SHA256
  
  298326b2b9dc71aa7d21fd69f1192fbda1a1003ef9eb92dec9300cbbc2227bba
- SHA512
  
  2809c598bb8c6d4396a7ab520fd5f0049c90905d71bd71ac84d13508b8acdb4fccda95a55cbe9ebae5589b631a7f9b876284edbd09daf092fa5b76da5b2a3641
- SSDEEP
  
  12288:0MrKy90QQM95Op+uF1QzCsF+gMaTymNR8ofTb+E:uyZFuFWHTymNR8oLbx
Score

10^/10

amadey evasion persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

static1

behavioral1

amadeyevasionpersistencetrojan