Overview

overview

10

Static

static

10

47ba290f4b...91.exe

windows7-x64

10

47ba290f4b...91.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    47ba290f4bcf2a712c5d95e9f2d4b84726d3a51dadf56e884d167c8abd475b91

  • Size

    109KB

  • Sample

    231016-q72c2ahh33

  • MD5

    cc322efab5bb7522772a7f28fb789d98

  • SHA1

    86c53e66a5583843edbcd0bd3c61926da2c7902d

  • SHA256

    341aebd6f8b440e3b18b2d193100a35d668018d1475f1bb7cf60df573b30b6e3

  • SHA512

    8c177050cbaa1b40e48c0ea6f858e4e07efe35a6e11cf902bcc057af05f1257964b7ca649d4b5b2dc2d478c558b0ec6fc349d7cd7b9ead7dbe6d2a5868956470

  • SSDEEP

    3072:Ud9E3VA8jatPJDKe8Hy51J0unruLe0W4E:Udmj6hzzFnaq0W4E

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

    • Target

      47ba290f4bcf2a712c5d95e9f2d4b84726d3a51dadf56e884d167c8abd475b91

    • Size

      240KB

    • MD5

      4ffa27b6fa77e9e4af1acac0a0297415

    • SHA1

      a896d5d9bc51e301fdde2405151666b42b37a0ad

    • SHA256

      47ba290f4bcf2a712c5d95e9f2d4b84726d3a51dadf56e884d167c8abd475b91

    • SHA512

      6c734fcc2da575e711e0d9c841a19901b277334d364d5f0d6f8c243e817718e6b2991d3b29d640e6543f987e72f9d66ef35ee82b746110872bd426dec3b39444

    • SSDEEP

      6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks