General

  • Target

    0x000200000001f7492447.dat

  • Size

    230KB

  • Sample

    230506-zaq1gabh68

  • MD5

    f6c0933913ce1a49224bdbbb8a61c788

  • SHA1

    8b4b1b581a497bb44e4ccf365c284a57dae4ab6d

  • SHA256

    d5325e8b9f7e79cabba1c88b0225f85fa02fb2d96034e91f91cacdf6afa41c00

  • SHA512

    45f333dff205e2842db50b9b3bd49ee85f990b202bfe78d950762072a6422c6b3f7ae669f063dd881989ae07c0c38332aae8ba3df5ccda866bd1c9caac947e55

  • SSDEEP

    6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      0x000200000001f7492447.dat

    • Size

      230KB

    • MD5

      f6c0933913ce1a49224bdbbb8a61c788

    • SHA1

      8b4b1b581a497bb44e4ccf365c284a57dae4ab6d

    • SHA256

      d5325e8b9f7e79cabba1c88b0225f85fa02fb2d96034e91f91cacdf6afa41c00

    • SHA512

      45f333dff205e2842db50b9b3bd49ee85f990b202bfe78d950762072a6422c6b3f7ae669f063dd881989ae07c0c38332aae8ba3df5ccda866bd1c9caac947e55

    • SSDEEP

      6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks