General

  • Target

    bot.exe

  • Size

    229KB

  • Sample

    230420-knwesagf59

  • MD5

    16507e0d31203c35d54e4deca192b4bb

  • SHA1

    b25ab6686ff5fa410bc1b24fc123cc42bff78c27

  • SHA256

    1b91c65e1678d7a0101659f5509c60a879ac638e2958d16bfc4100b8b1d6c825

  • SHA512

    5eb3b9fde3360989c397c5c16fd3724f84f14658710fb0d6f03acf51d358df96a9cbdc0797b7af298f334c6898aacbd54bc524e38a1cad6584b260b7cf34d248

  • SSDEEP

    6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Targets

    • Target

      bot.exe

    • Size

      229KB

    • MD5

      16507e0d31203c35d54e4deca192b4bb

    • SHA1

      b25ab6686ff5fa410bc1b24fc123cc42bff78c27

    • SHA256

      1b91c65e1678d7a0101659f5509c60a879ac638e2958d16bfc4100b8b1d6c825

    • SHA512

      5eb3b9fde3360989c397c5c16fd3724f84f14658710fb0d6f03acf51d358df96a9cbdc0797b7af298f334c6898aacbd54bc524e38a1cad6584b260b7cf34d248

    • SSDEEP

      6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks