amadey | 215b2b4cf2d3c72c055ed5f2ebbc49e13d98ab89b32e79a203041845a1f8bda8 | Triage

Sharing

General

Target

0x0007000000012683-92.dat
Size

209KB
Sample

230610-dtwt6seh3v
MD5

1a12cc5f11658d31e2ee8fb1b8d5f4bc
SHA1

46972030f70134e68bdbf70c8414ec2b3a8d4421
SHA256

215b2b4cf2d3c72c055ed5f2ebbc49e13d98ab89b32e79a203041845a1f8bda8
SHA512

88e99f00c1be964b74829c4028e95a7f4a6b9a68fdaff6bacccd294874c8043f77f47b9fbf249a46f54cf5f964b241808478f134ab844d605b74b4fcc5759f5f
SSDEEP

3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.83

C2

77.91.68.30/music/rock/index.php

Targets

- Target
  
  0x0007000000012683-92.dat
- Size
  
  209KB
- MD5
  
  1a12cc5f11658d31e2ee8fb1b8d5f4bc
- SHA1
  
  46972030f70134e68bdbf70c8414ec2b3a8d4421
- SHA256
  
  215b2b4cf2d3c72c055ed5f2ebbc49e13d98ab89b32e79a203041845a1f8bda8
- SHA512
  
  88e99f00c1be964b74829c4028e95a7f4a6b9a68fdaff6bacccd294874c8043f77f47b9fbf249a46f54cf5f964b241808478f134ab844d605b74b4fcc5759f5f
- SSDEEP
  
  3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
Score

10^/10

amadey trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2