General

  • Target

    0x0006000000022fa1-203.dat

  • Size

    206KB

  • Sample

    230614-x8lsasda45

  • MD5

    03882f439263b57f2d79a887a2425e9d

  • SHA1

    2cb37f4202507a194bf1b1fa2bdae2500cc63b67

  • SHA256

    137607ab8853ef3d7616e169a064946a6b24dcb915278c7dae33318f77d2215c

  • SHA512

    8afdf492ca9d836934a439360d3fe0487ff4aae030b5f0590e3a4c1c7b469f447d8d45474ce9558ffa80ef70dab074e76c03056acc0969f9ca41984c103ddf56

  • SSDEEP

    3072:WpxiMVc/oooAUNfLp1zuNW3KG7uON8wAuZA+6jbe83xfbq5kmh:siMV5oofVu432OiuZAlXjq

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.81

C2

95.214.27.98/cronus/index.php

Targets

    • Target

      0x0006000000022fa1-203.dat

    • Size

      206KB

    • MD5

      03882f439263b57f2d79a887a2425e9d

    • SHA1

      2cb37f4202507a194bf1b1fa2bdae2500cc63b67

    • SHA256

      137607ab8853ef3d7616e169a064946a6b24dcb915278c7dae33318f77d2215c

    • SHA512

      8afdf492ca9d836934a439360d3fe0487ff4aae030b5f0590e3a4c1c7b469f447d8d45474ce9558ffa80ef70dab074e76c03056acc0969f9ca41984c103ddf56

    • SSDEEP

      3072:WpxiMVc/oooAUNfLp1zuNW3KG7uON8wAuZA+6jbe83xfbq5kmh:siMV5oofVu432OiuZAlXjq

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks