Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f91d8de3cd76af86c06ec121a4978b5d6f5076e9835627dc358a50a7e48b7c3

  • Size

    558KB

  • Sample

    230207-cz473aha99

  • MD5

    3fa834922a17e6a24f43e65f834f44b9

  • SHA1

    f8cca66affaf697954bc18c54e6937148b2912c8

  • SHA256

    4f91d8de3cd76af86c06ec121a4978b5d6f5076e9835627dc358a50a7e48b7c3

  • SHA512

    4c3d23daca2738f52694ce553c8421b4b35d91fa06462307b663dc49a2bcad9003bc3c974598a717f697333fc36bfcc39c151bc0e6dc5f6c9fd30b7f6ab28740

  • SSDEEP

    6144:KJy+bnr+np0yN90QEJl2BJnuI/H9Q9sx44F8GYXhG3/uL2mv4CSthsOSzlywB08L:TMrny90onbYsJGhGlCS/sOQKvTsBno0

Score
10/10
amadeyevasionpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      4f91d8de3cd76af86c06ec121a4978b5d6f5076e9835627dc358a50a7e48b7c3

    • Size

      558KB

    • MD5

      3fa834922a17e6a24f43e65f834f44b9

    • SHA1

      f8cca66affaf697954bc18c54e6937148b2912c8

    • SHA256

      4f91d8de3cd76af86c06ec121a4978b5d6f5076e9835627dc358a50a7e48b7c3

    • SHA512

      4c3d23daca2738f52694ce553c8421b4b35d91fa06462307b663dc49a2bcad9003bc3c974598a717f697333fc36bfcc39c151bc0e6dc5f6c9fd30b7f6ab28740

    • SSDEEP

      6144:KJy+bnr+np0yN90QEJl2BJnuI/H9Q9sx44F8GYXhG3/uL2mv4CSthsOSzlywB08L:TMrny90onbYsJGhGlCS/sOQKvTsBno0

    Score
    10/10
    amadeyevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks