General

  • Target

    0x0006000000022e5f-27.dat

  • Size

    221KB

  • Sample

    231030-pse1taeg47

  • MD5

    d220903d17ec1b85e2d378d208f83099

  • SHA1

    2c3f67aee648a37cb8b1bccc2fc0a9d44babde87

  • SHA256

    d9dc8bb967584a69207ee08e3c9a2bf1f6ce624b06f9e7ed0f28b1a27e34ba7c

  • SHA512

    22342d3f3faca5f6d2a5c1d659d030240e1c7d1412a399257fd29e92aea4b8ec18fbec058d7c2a7ca67b0af642d06fe1b6999ac1d99799b33d992573f7e8aedf

  • SSDEEP

    6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

    • Target

      0x0006000000022e5f-27.dat

    • Size

      221KB

    • MD5

      d220903d17ec1b85e2d378d208f83099

    • SHA1

      2c3f67aee648a37cb8b1bccc2fc0a9d44babde87

    • SHA256

      d9dc8bb967584a69207ee08e3c9a2bf1f6ce624b06f9e7ed0f28b1a27e34ba7c

    • SHA512

      22342d3f3faca5f6d2a5c1d659d030240e1c7d1412a399257fd29e92aea4b8ec18fbec058d7c2a7ca67b0af642d06fe1b6999ac1d99799b33d992573f7e8aedf

    • SSDEEP

      6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks