General

  • Target

    03221399.dat

  • Size

    206KB

  • Sample

    230615-plxx2sgf9w

  • MD5

    994879cdf2831b0fc959c101265b218c

  • SHA1

    a1b388949efa1422200e21f2ca271eaca084c94e

  • SHA256

    295d0cbcdd033926ce9b3e90025c355823a4415f717b07de0c48f4b0fc419a17

  • SHA512

    92c6f8f9f4960ac3054278ad645f77905a88a16d904464ae51b9c508c4914e6042642a7cbd3f6a7d0831cf0ed4c6851f64893acf302286edc9830f398fa602b5

  • SSDEEP

    3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

    • Target

      03221399.dat

    • Size

      206KB

    • MD5

      994879cdf2831b0fc959c101265b218c

    • SHA1

      a1b388949efa1422200e21f2ca271eaca084c94e

    • SHA256

      295d0cbcdd033926ce9b3e90025c355823a4415f717b07de0c48f4b0fc419a17

    • SHA512

      92c6f8f9f4960ac3054278ad645f77905a88a16d904464ae51b9c508c4914e6042642a7cbd3f6a7d0831cf0ed4c6851f64893acf302286edc9830f398fa602b5

    • SSDEEP

      3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks