General

  • Target

    db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

  • Size

    205KB

  • Sample

    230617-bj98pshc4z

  • MD5

    79fa4eabaa10e7eade4ca7774f913964

  • SHA1

    e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

  • SHA256

    db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

  • SHA512

    09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

  • SSDEEP

    3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

    • Target

      db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

    • Size

      205KB

    • MD5

      79fa4eabaa10e7eade4ca7774f913964

    • SHA1

      e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

    • SHA256

      db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

    • SHA512

      09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

    • SSDEEP

      3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks