Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3602c16c836895f2e8f0cc6dcaae7f598a69b8ad72556bd2c5643c2b6972e8f

  • Size

    558KB

  • Sample

    230207-cj6qyscb7v

  • MD5

    b222068aa3d9de0fcf14bd9d85d6b3a3

  • SHA1

    c549cb417b461a60c8a852d6fb5f370d1e1cd2a6

  • SHA256

    f3602c16c836895f2e8f0cc6dcaae7f598a69b8ad72556bd2c5643c2b6972e8f

  • SHA512

    8e17920231c8175b6299a189386340ee77efd936e7b5631e970ee578018d0a3675a6e06badec562631c96f098849305aa90bdf5be95e09ddaddac4857de9cbf9

  • SSDEEP

    12288:zMrry90zQYsvulu14Al4NPCm7sOk4jAH96F:Eyh3v6HjtCm7sOSQF

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

Targets

    • Target

      f3602c16c836895f2e8f0cc6dcaae7f598a69b8ad72556bd2c5643c2b6972e8f

    • Size

      558KB

    • MD5

      b222068aa3d9de0fcf14bd9d85d6b3a3

    • SHA1

      c549cb417b461a60c8a852d6fb5f370d1e1cd2a6

    • SHA256

      f3602c16c836895f2e8f0cc6dcaae7f598a69b8ad72556bd2c5643c2b6972e8f

    • SHA512

      8e17920231c8175b6299a189386340ee77efd936e7b5631e970ee578018d0a3675a6e06badec562631c96f098849305aa90bdf5be95e09ddaddac4857de9cbf9

    • SSDEEP

      12288:zMrry90zQYsvulu14Al4NPCm7sOk4jAH96F:Eyh3v6HjtCm7sOSQF

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks