Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80c1f83413e609ce3cc1d115b3c6ce1f30988d8d34c519a7af9a0e850852bbfb

  • Size

    557KB

  • Sample

    230207-ce5m4aha42

  • MD5

    a6a92f982ac981af4762f6104f896c21

  • SHA1

    ee158f6e0f8fb65bb5fcf5aff3d15739ab30748f

  • SHA256

    80c1f83413e609ce3cc1d115b3c6ce1f30988d8d34c519a7af9a0e850852bbfb

  • SHA512

    351a0c36dc399f45ebb75b56d9d1e16b872859ec232ba6977f936b53fba45c88174165266907a8ba402edc855e14a55a947b90a1dbb9ee7b8a5e86b20ffdef63

  • SSDEEP

    12288:IMrLy9043zNoL0F3ZNC2HsOMADiVLQe4h:zyjBoLSpNC2HsOr+Ah

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

Targets

    • Target

      80c1f83413e609ce3cc1d115b3c6ce1f30988d8d34c519a7af9a0e850852bbfb

    • Size

      557KB

    • MD5

      a6a92f982ac981af4762f6104f896c21

    • SHA1

      ee158f6e0f8fb65bb5fcf5aff3d15739ab30748f

    • SHA256

      80c1f83413e609ce3cc1d115b3c6ce1f30988d8d34c519a7af9a0e850852bbfb

    • SHA512

      351a0c36dc399f45ebb75b56d9d1e16b872859ec232ba6977f936b53fba45c88174165266907a8ba402edc855e14a55a947b90a1dbb9ee7b8a5e86b20ffdef63

    • SSDEEP

      12288:IMrLy9043zNoL0F3ZNC2HsOMADiVLQe4h:zyjBoLSpNC2HsOr+Ah

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks