amadey | 10b84e9507c39f349d5f02ba2c63e8cd980a7b48492ddab7217ed0212dee10ff | Triage

Sharing

General

Target

0x00070000000126ff-120.dat
Size

209KB
Sample

230609-a6zj2sbc5t
MD5

4f564dd20d742a28d4ed599896f38bb0
SHA1

a1cee68424125cb6b462216bbbf1990e68c3bcbf
SHA256

10b84e9507c39f349d5f02ba2c63e8cd980a7b48492ddab7217ed0212dee10ff
SHA512

2c5d2f76e9269f37efb9648c6f99dbdb5b9e28bbb67dcfcd92291eabd4414a84dd10413f607dc9638db6a751896f9425cb3ae0675e8d53a4116750b9e4b59a90
SSDEEP

3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.83

C2

77.91.68.30/music/rock/index.php

Targets

- Target
  
  0x00070000000126ff-120.dat
- Size
  
  209KB
- MD5
  
  4f564dd20d742a28d4ed599896f38bb0
- SHA1
  
  a1cee68424125cb6b462216bbbf1990e68c3bcbf
- SHA256
  
  10b84e9507c39f349d5f02ba2c63e8cd980a7b48492ddab7217ed0212dee10ff
- SHA512
  
  2c5d2f76e9269f37efb9648c6f99dbdb5b9e28bbb67dcfcd92291eabd4414a84dd10413f607dc9638db6a751896f9425cb3ae0675e8d53a4116750b9e4b59a90
- SSDEEP
  
  3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
Score

10^/10

amadey trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2