General

  • Target

    cf098978cadb89f8b88f475dc0737526ea63bc8ac71e3361ded1c0a4f44f053b

  • Size

    950KB

  • Sample

    230424-aayb4sac3y

  • MD5

    8624122c77b6ab0e8d4c8f6a8a1e25d5

  • SHA1

    b58bd534a7b1f001a655d9f3bc82450fff287cee

  • SHA256

    cf098978cadb89f8b88f475dc0737526ea63bc8ac71e3361ded1c0a4f44f053b

  • SHA512

    538d3d237384b1d39531bfc2f7b972fd243f3c93f002e1a660903e75e8d0a68babd93ff18b5433a23fce666c5db80cc4fa769cb58de86f1279d55e4270957ff9

  • SSDEEP

    24576:Uygncy2KLzqqU8u4g3H0X1I1YAQ0e+6CP1sh:jVyoqtu4gq1I1TQ0e+4

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      cf098978cadb89f8b88f475dc0737526ea63bc8ac71e3361ded1c0a4f44f053b

    • Size

      950KB

    • MD5

      8624122c77b6ab0e8d4c8f6a8a1e25d5

    • SHA1

      b58bd534a7b1f001a655d9f3bc82450fff287cee

    • SHA256

      cf098978cadb89f8b88f475dc0737526ea63bc8ac71e3361ded1c0a4f44f053b

    • SHA512

      538d3d237384b1d39531bfc2f7b972fd243f3c93f002e1a660903e75e8d0a68babd93ff18b5433a23fce666c5db80cc4fa769cb58de86f1279d55e4270957ff9

    • SSDEEP

      24576:Uygncy2KLzqqU8u4g3H0X1I1YAQ0e+6CP1sh:jVyoqtu4gq1I1TQ0e+4

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks