Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eadcabe5d7c244f95856dbc1b70951dbb294435e23f235df48f661ff9ebf1b10

  • Size

    558KB

  • Sample

    230207-aasrmage56

  • MD5

    24d66ef57fc8316cc362372b6ecea4a2

  • SHA1

    7a0d5d2b0dbd598b10e152e104a5b621c5cea7af

  • SHA256

    eadcabe5d7c244f95856dbc1b70951dbb294435e23f235df48f661ff9ebf1b10

  • SHA512

    ac398e7cbae218a27a0e592643159433457e22c58909d73bee173eff8f9c19565e19313f5446336e8fb3ee636aa72a9abe0a19d10c51ed68867b6a8065c7b204

  • SSDEEP

    12288:7Mr7y90XmYyrTDPKRzOqj6HRG07ZqeMA6ySr/Ihb:Yyg96Tz1qje7ZWzS

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

Targets

    • Target

      eadcabe5d7c244f95856dbc1b70951dbb294435e23f235df48f661ff9ebf1b10

    • Size

      558KB

    • MD5

      24d66ef57fc8316cc362372b6ecea4a2

    • SHA1

      7a0d5d2b0dbd598b10e152e104a5b621c5cea7af

    • SHA256

      eadcabe5d7c244f95856dbc1b70951dbb294435e23f235df48f661ff9ebf1b10

    • SHA512

      ac398e7cbae218a27a0e592643159433457e22c58909d73bee173eff8f9c19565e19313f5446336e8fb3ee636aa72a9abe0a19d10c51ed68867b6a8065c7b204

    • SSDEEP

      12288:7Mr7y90XmYyrTDPKRzOqj6HRG07ZqeMA6ySr/Ihb:Yyg96Tz1qje7ZWzS

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks