General

  • Target

    0x00080000000122e3-92.dat

  • Size

    205KB

  • Sample

    230614-nw56qsgc22

  • MD5

    7e551be5fe2e9a53a674ea9ad0d433f1

  • SHA1

    2e987c8f927934a6b73a006b5e790e30b346db6a

  • SHA256

    1efa3603a55a50326cae71d6a1d23f753bb52ca0cc7724989703028f0cbd38a0

  • SHA512

    ee15c83d7e2da44515857d52a655b3752e36d16eaa180471f114d6397a17750b0b2d0c83e6b45b83f9d29842297d2fd2c2c0a1793179bc28dfb48c91d26045d4

  • SSDEEP

    3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

    • Target

      0x00080000000122e3-92.dat

    • Size

      205KB

    • MD5

      7e551be5fe2e9a53a674ea9ad0d433f1

    • SHA1

      2e987c8f927934a6b73a006b5e790e30b346db6a

    • SHA256

      1efa3603a55a50326cae71d6a1d23f753bb52ca0cc7724989703028f0cbd38a0

    • SHA512

      ee15c83d7e2da44515857d52a655b3752e36d16eaa180471f114d6397a17750b0b2d0c83e6b45b83f9d29842297d2fd2c2c0a1793179bc28dfb48c91d26045d4

    • SSDEEP

      3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks