General

  • Target

    0x00080000000122d1-2011.dat

  • Size

    239KB

  • Sample

    230302-m6m78scf33

  • MD5

    49090a10a59fad9f90d929853eb3bd24

  • SHA1

    813e2de7d037932c2904fa94dbb53a31d816a273

  • SHA256

    724a871afd9afaecbe260ed0c34eec9cf9e3765d4e1695b771fc852244221507

  • SHA512

    6c2649c0cd8172ca1b8dbd64300671f0e6572da676d28633393ca678e2f781c65f830794349da3a181271da7293d2c27407d8c0e213ee9523b5cfa0802840350

  • SSDEEP

    6144:u6f3mSV2p10caphMnboArJMuVyhpLT7FC2y8nU:uTb0caE0A2uVybLT7FChd

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.67

C2

193.233.20.14/BR54nmB3/index.php

Targets

    • Target

      0x00080000000122d1-2011.dat

    • Size

      239KB

    • MD5

      49090a10a59fad9f90d929853eb3bd24

    • SHA1

      813e2de7d037932c2904fa94dbb53a31d816a273

    • SHA256

      724a871afd9afaecbe260ed0c34eec9cf9e3765d4e1695b771fc852244221507

    • SHA512

      6c2649c0cd8172ca1b8dbd64300671f0e6572da676d28633393ca678e2f781c65f830794349da3a181271da7293d2c27407d8c0e213ee9523b5cfa0802840350

    • SSDEEP

      6144:u6f3mSV2p10caphMnboArJMuVyhpLT7FC2y8nU:uTb0caE0A2uVybLT7FChd

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks