amadey | 1284c87b697a0b5cae7169c11a6b2b898f7a4d9aa4dfc35a18e57ec1bd84325c | Triage

Sharing

General

Target

0x0006000000014720-121.dat
Size

211KB
Sample

230611-awp8magb47
MD5

1776971144d670c4ec831285da04e4a6
SHA1

21b22325ff73be1e78b4dfbfa4e20d1432bf05d6
SHA256

1284c87b697a0b5cae7169c11a6b2b898f7a4d9aa4dfc35a18e57ec1bd84325c
SHA512

a9319c2a3a1d150858eb71fb9d64fe5e04cabad203cd90dd67025bd576d2d9e2f16387675668196e7a64ab3b563b89419d2bce2a7fcb5c7bfabcf84ecbac5f71
SSDEEP

3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.83

C2

77.91.68.30/music/rock/index.php

Targets

- Target
  
  0x0006000000014720-121.dat
- Size
  
  211KB
- MD5
  
  1776971144d670c4ec831285da04e4a6
- SHA1
  
  21b22325ff73be1e78b4dfbfa4e20d1432bf05d6
- SHA256
  
  1284c87b697a0b5cae7169c11a6b2b898f7a4d9aa4dfc35a18e57ec1bd84325c
- SHA512
  
  a9319c2a3a1d150858eb71fb9d64fe5e04cabad203cd90dd67025bd576d2d9e2f16387675668196e7a64ab3b563b89419d2bce2a7fcb5c7bfabcf84ecbac5f71
- SSDEEP
  
  3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
Score

10^/10

amadey trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2