Overview

overview

10

Static

static

1

SKMBT18276392733.bat

windows7-x64

8

SKMBT18276392733.bat

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    SKMBT18276392733.bat

  • Size

    22KB

  • Sample

    230517-ycc1ysgc35

  • MD5

    244584512d6decb0d37cef150886e636

  • SHA1

    fe50c7e039605957ab9bfd034f7861e6023d0093

  • SHA256

    56107979d024223bd4ba443cf654ebfc32e19a3eaffd7a055fadb6ac1ce97866

  • SHA512

    24613bbe96ab7befac49f8d4acd6b8a9d14bb0add1651412c0859d4031feabd2aa40e8e582a449af7acbb0eba6776de1b65f0ead759c7fcf089bf3d12eb46243

  • SSDEEP

    384:b2VPeJS3xtpEG3cZrUKUE0gMGfa9720wvjeqzAzW6yeVf9jlP7JYK5zf8rh:bUWJS3xwQ8rUwMaaJ20wvjj0zLVRlzO5

Score
10/10
amadeyevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      SKMBT18276392733.bat

    • Size

      22KB

    • MD5

      244584512d6decb0d37cef150886e636

    • SHA1

      fe50c7e039605957ab9bfd034f7861e6023d0093

    • SHA256

      56107979d024223bd4ba443cf654ebfc32e19a3eaffd7a055fadb6ac1ce97866

    • SHA512

      24613bbe96ab7befac49f8d4acd6b8a9d14bb0add1651412c0859d4031feabd2aa40e8e582a449af7acbb0eba6776de1b65f0ead759c7fcf089bf3d12eb46243

    • SSDEEP

      384:b2VPeJS3xtpEG3cZrUKUE0gMGfa9720wvjeqzAzW6yeVf9jlP7JYK5zf8rh:bUWJS3xwQ8rUwMaaJ20wvjj0zLVRlzO5

    Score
    10/10
    evasionamadeypersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • UAC bypass

      evasiontrojan

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks