Overview

overview

10

Static

static

10

ee99deaa87...11.exe

windows7-x64

10

ee99deaa87...11.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a3870c8daf819e77fb27a82949d0a3e1.bin

  • Size

    103KB

  • Sample

    231011-3p6k9aca5z

  • MD5

    91571cfdc01210e2c65298902449a7ba

  • SHA1

    3b0a568bb9d6f3ab8ea22b48356f822c5dbe6ebf

  • SHA256

    54a665102b6cb70c8e0f9ecad887b82e4ce0aca29dbdd86f76a449f9f4ba9a04

  • SHA512

    a5733bf9689d3db876477d31eb0c237c6a4c3115bcbc86ad49b0d5c0f8286d0f30cc1c06c395c3cae70cedb15a8fdbb2b6d47b5e574394b04c6edcce1ac2583d

  • SSDEEP

    3072:wHJjB4jxoI7DH1Pe4rgM/xjdS9HRGodkz1S3g:kJdwa7igUd6xGoi

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain

Targets

    • Target

      ee99deaa87f602f0ea98a596a43adf1b3383b94269ce44ba621900a808438311.exe

    • Size

      235KB

    • MD5

      a3870c8daf819e77fb27a82949d0a3e1

    • SHA1

      f4658c4ec41f11f8ea9d028b387fb0487b2120d1

    • SHA256

      ee99deaa87f602f0ea98a596a43adf1b3383b94269ce44ba621900a808438311

    • SHA512

      2d931a1942375d4ebfc4461bba687995c8e57ef26ac4ab313f4202ed5b2270e86b346ba1ec35141e569d69454c7a710a453530ecdd20fb0c25ef4846e20f01c5

    • SSDEEP

      6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks