General

  • Target

    dd09ac854d8cf93643c1cc08fa0184855e0e9719042980741f80516d99b92db5

  • Size

    1.4MB

  • Sample

    230831-fht8bacf61

  • MD5

    2317f3393576d390a9cfedabc929d076

  • SHA1

    b9e79ab5d0577e198e3c7359ef1cbce0ceaf0078

  • SHA256

    dd09ac854d8cf93643c1cc08fa0184855e0e9719042980741f80516d99b92db5

  • SHA512

    6c174841d0e7d7ebc3e55357a6cd89cbf532fc30b8ae10502b368c5e1faf227331c85e1a1f85bdcea8f1faf2870a8903ba294be994feba02809528c1e4ae7dfd

  • SSDEEP

    24576:iyDEgu+4ymK2YKJGvLFI1wGPUs/BrjEJt/NtTJlerUsse62A6ZmKv:JDEgbPmkKJGvLe1UyrjEJtlB/wWT+H

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

rc4.plain

Targets

    • Target

      dd09ac854d8cf93643c1cc08fa0184855e0e9719042980741f80516d99b92db5

    • Size

      1.4MB

    • MD5

      2317f3393576d390a9cfedabc929d076

    • SHA1

      b9e79ab5d0577e198e3c7359ef1cbce0ceaf0078

    • SHA256

      dd09ac854d8cf93643c1cc08fa0184855e0e9719042980741f80516d99b92db5

    • SHA512

      6c174841d0e7d7ebc3e55357a6cd89cbf532fc30b8ae10502b368c5e1faf227331c85e1a1f85bdcea8f1faf2870a8903ba294be994feba02809528c1e4ae7dfd

    • SSDEEP

      24576:iyDEgu+4ymK2YKJGvLFI1wGPUs/BrjEJt/NtTJlerUsse62A6ZmKv:JDEgbPmkKJGvLe1UyrjEJtlB/wWT+H

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks