General

  • Target

    NEAS.b225607c332d7937a27569ade7f66600.exe

  • Size

    236KB

  • Sample

    231014-xtx7sagg59

  • MD5

    b225607c332d7937a27569ade7f66600

  • SHA1

    740bfaca1280f039b52d1b9604c02f55abebbc90

  • SHA256

    1f1b325339b0259595dbbc41e23d33ac032cea1f5fbd579540258e59ca7c2d2b

  • SHA512

    3a1eb42cc3ddaf18c44e3faf0323d76d6097b194e5c5b09ab5be15815fd287fbb9267d362e510b00dfeba2674f955bc5d1c4f393fe401b3af7bae1f11cc902b8

  • SSDEEP

    6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

    • Target

      NEAS.b225607c332d7937a27569ade7f66600.exe

    • Size

      236KB

    • MD5

      b225607c332d7937a27569ade7f66600

    • SHA1

      740bfaca1280f039b52d1b9604c02f55abebbc90

    • SHA256

      1f1b325339b0259595dbbc41e23d33ac032cea1f5fbd579540258e59ca7c2d2b

    • SHA512

      3a1eb42cc3ddaf18c44e3faf0323d76d6097b194e5c5b09ab5be15815fd287fbb9267d362e510b00dfeba2674f955bc5d1c4f393fe401b3af7bae1f11cc902b8

    • SSDEEP

      6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks