Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eae36e3227e7022ccd5c273d7b595737d728288c46293f73de3b7b24b5fb6682

  • Size

    1.1MB

  • Sample

    230419-q9xgvscg4z

  • MD5

    78770ed55450d5cf3be02a4ceed080af

  • SHA1

    34ae2943e0cf50b9639e0f9ef8e7d0e11f57b5af

  • SHA256

    eae36e3227e7022ccd5c273d7b595737d728288c46293f73de3b7b24b5fb6682

  • SHA512

    77c073f454f99ff0f2587feffa52646b745b18eb0df732df760251d9d8665602d6fecd8af33e45553ff280b751ee5c229017013834e5bbf79c8c9a5096ead12b

  • SSDEEP

    24576:ky3B0hezlR3g1E3/NxeBane6hwtsqa1ZsLbLobCUEK:zR0hehRhFABane6hZqangAbCH

Score
10/10
amadeyauroradiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

aurora

C2

89.208.103.78:8081

Targets

    • Target

      eae36e3227e7022ccd5c273d7b595737d728288c46293f73de3b7b24b5fb6682

    • Size

      1.1MB

    • MD5

      78770ed55450d5cf3be02a4ceed080af

    • SHA1

      34ae2943e0cf50b9639e0f9ef8e7d0e11f57b5af

    • SHA256

      eae36e3227e7022ccd5c273d7b595737d728288c46293f73de3b7b24b5fb6682

    • SHA512

      77c073f454f99ff0f2587feffa52646b745b18eb0df732df760251d9d8665602d6fecd8af33e45553ff280b751ee5c229017013834e5bbf79c8c9a5096ead12b

    • SSDEEP

      24576:ky3B0hezlR3g1E3/NxeBane6hwtsqa1ZsLbLobCUEK:zR0hehRhFABane6hZqangAbCH

    Score
    10/10
    amadeyauroradiscoveryevasionpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks