General

  • Target

    02077099.dat

  • Size

    205KB

  • Sample

    230614-pc5xasge83

  • MD5

    bb8a22a2c30a13cb97ebebe343318bc1

  • SHA1

    56260480acd4e1bbda80e451cc1f8ed8978ad3b2

  • SHA256

    068e2d377d119e350eaad8dab3bd194004c3cd15f3f5aa930378c4cc94c31c9b

  • SHA512

    fbc6403139a22d09679ba513e383e38d01eaa3dc1efa7168c59a525a96eb7faf3c715cdbf4c0260787c85b54dbc2fcab89017da2d4790e564635078a04d2ab14

  • SSDEEP

    3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

    • Target

      02077099.dat

    • Size

      205KB

    • MD5

      bb8a22a2c30a13cb97ebebe343318bc1

    • SHA1

      56260480acd4e1bbda80e451cc1f8ed8978ad3b2

    • SHA256

      068e2d377d119e350eaad8dab3bd194004c3cd15f3f5aa930378c4cc94c31c9b

    • SHA512

      fbc6403139a22d09679ba513e383e38d01eaa3dc1efa7168c59a525a96eb7faf3c715cdbf4c0260787c85b54dbc2fcab89017da2d4790e564635078a04d2ab14

    • SSDEEP

      3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks