General

  • Target

    5sI78QS.exe

  • Size

    231KB

  • Sample

    231010-bdtc1abf43

  • MD5

    2d80e0f6b65e4dea706d65f562708a41

  • SHA1

    a92c0fb256a46ff067f4a2f087771703a87ad0ef

  • SHA256

    9d8b54bc38ad0e014f70db22745e5fda4dfb71b7c5dca0ea7458aacd4e50cf6b

  • SHA512

    8deb6ef463ac977a1cb38b04d32b17390c1a9bcef634979b1adb1f169878603000482106e7f6eea2c1f3fb6fa0876ba9ae94b1f3c0b981914cc177eea58f84f1

  • SSDEEP

    6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

    • Target

      5sI78QS.exe

    • Size

      231KB

    • MD5

      2d80e0f6b65e4dea706d65f562708a41

    • SHA1

      a92c0fb256a46ff067f4a2f087771703a87ad0ef

    • SHA256

      9d8b54bc38ad0e014f70db22745e5fda4dfb71b7c5dca0ea7458aacd4e50cf6b

    • SHA512

      8deb6ef463ac977a1cb38b04d32b17390c1a9bcef634979b1adb1f169878603000482106e7f6eea2c1f3fb6fa0876ba9ae94b1f3c0b981914cc177eea58f84f1

    • SSDEEP

      6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks