Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5ab865f6b7099468a81c9a2518d7c386b4e685ab35125d3e3596f0c30e72f2e8

  • Size

    808KB

  • Sample

    230421-sqa6magc72

  • MD5

    c4f1c6e979500e8e3c740f42a445127e

  • SHA1

    62e6f86faf35a74097bc135bd3c6970f739432b0

  • SHA256

    5ab865f6b7099468a81c9a2518d7c386b4e685ab35125d3e3596f0c30e72f2e8

  • SHA512

    89ed752ea695e2a19896c5fc7596ffd71a12e30ec52e978ebe380f21e21662808e42036c8f72a1cd0a141e9c7c88071bbdb4e8ce7348aae9599aeae271fa3f35

  • SSDEEP

    12288:gy90//5kYUcoyACBIBREw2tL2gQHV9uGKqaLBSBUlJ4wfvxt/rwH/hm:gysOvhnzPE+rNKqaLBSqJ5VwH/hm

Score
10/10
amadeydiscoveryevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      5ab865f6b7099468a81c9a2518d7c386b4e685ab35125d3e3596f0c30e72f2e8

    • Size

      808KB

    • MD5

      c4f1c6e979500e8e3c740f42a445127e

    • SHA1

      62e6f86faf35a74097bc135bd3c6970f739432b0

    • SHA256

      5ab865f6b7099468a81c9a2518d7c386b4e685ab35125d3e3596f0c30e72f2e8

    • SHA512

      89ed752ea695e2a19896c5fc7596ffd71a12e30ec52e978ebe380f21e21662808e42036c8f72a1cd0a141e9c7c88071bbdb4e8ce7348aae9599aeae271fa3f35

    • SSDEEP

      12288:gy90//5kYUcoyACBIBREw2tL2gQHV9uGKqaLBSBUlJ4wfvxt/rwH/hm:gysOvhnzPE+rNKqaLBSqJ5VwH/hm

    Score
    10/10
    amadeydiscoveryevasionpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks