Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    00e17ee2113e9dd91078210819392fd0921480554f626edaae855a9aeeb1e179

  • Size

    1.1MB

  • Sample

    230418-n5vrcsda2t

  • MD5

    38eb06f7493b588f81d271f9085e1c05

  • SHA1

    d625b88871a56b65c09bf4f492675936de632246

  • SHA256

    00e17ee2113e9dd91078210819392fd0921480554f626edaae855a9aeeb1e179

  • SHA512

    40873f35ba0343720a1e8d19e84edfaf77ad8e1c0bc5d3830fe85039fa399a55d3be35488d25e036694fba19d60e8afca676f053e68069bb80e735669536223f

  • SSDEEP

    24576:VyM+3Tt/tvBD1EGs6tsi/gn4KKkrZmK1hbAT9n06M77GVX:wMst/mzcgXdzJ/77u

Score
10/10
amadeydiscoveryevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      00e17ee2113e9dd91078210819392fd0921480554f626edaae855a9aeeb1e179

    • Size

      1.1MB

    • MD5

      38eb06f7493b588f81d271f9085e1c05

    • SHA1

      d625b88871a56b65c09bf4f492675936de632246

    • SHA256

      00e17ee2113e9dd91078210819392fd0921480554f626edaae855a9aeeb1e179

    • SHA512

      40873f35ba0343720a1e8d19e84edfaf77ad8e1c0bc5d3830fe85039fa399a55d3be35488d25e036694fba19d60e8afca676f053e68069bb80e735669536223f

    • SSDEEP

      24576:VyM+3Tt/tvBD1EGs6tsi/gn4KKkrZmK1hbAT9n06M77GVX:wMst/mzcgXdzJ/77u

    Score
    10/10
    amadeydiscoveryevasionpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks