amadey

General

Target

3d854a29c35902e2ef8ad796f7b62108.bin
Size

1.6MB
Sample

231026-bvewyabc3y
MD5

6679b8f4c01d64d1fb9e98b16554aa15
SHA1

b5d71a254323d4746eb02d587266e4cc205a3969
SHA256

796199ec3ddd4946a86bb2373fedc9f6b40bfa564eeb8396cd48cd1b8113cded
SHA512

38126692dbc035df185a3464eaa8d73af50fb8335a47e16f339e66d6a30cad4bd929955bf00af42a23adc0f1ec5efb471e673383ad8a9bf3729b9bf808199957
SSDEEP

24576:3twDNWhyFdqwY6QYbCDLXslMSF2KT6gaF5Vq+oxLWSCdPLRay2sBsPAXRJXRAAh5:3KDAsFdo6Q0MXslMSv6dMzWdDDlAaxfX

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

2.03

Attributes

install_dir
3101f8f780
install_file
gbudn.exe
strings_key
98efc0765f4c223e79368db4c8650353

rc4.plain

Targets

- Target
  
  mtk.exe
- Size
  
  4.0MB
- MD5
  
  0dbaff61a0d7eb35c23542fe980c8e30
- SHA1
  
  a65bce229a1f0143c6f5c86a205da15d74652335
- SHA256
  
  0771ddc1515150cf7bb2eaed7ce17db58bf1f3f963ec60b28e29266763c92594
- SHA512
  
  d59cc95efbb06b98b32ab0f52596aad4cf8b72a2390cddee8237301ee284995421fe98aff13a967db34d49759feaeac51f76e23d4d49397ef81fb003075adfc7
- SSDEEP
  
  49152:5hkVUncRtu1kPxXzEgDH/0nl0efk6e4Ath5+hY7hYKJ+NFK2Z0N/eEDNIGuWFlva:qxJDhlEF0N/e06Wrghxt
Score

10^/10

amadey mimikatz neshta strongpity evasion persistence ransomware spyware stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Neshta payload
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- StrongPity
  StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
  stealer spyware strongpity
- StrongPity Spyware
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- mimikatz is an open source tool to dump credentials on Windows
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Winexe tool used by Sofacy APT in several incidents
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2