Overview

overview

10

Static

static

3

75e8dfc1b9...92.exe

windows7-x64

10

75e8dfc1b9...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75e8dfc1b905f37971df736c6fe18f8a0d952973665bccaa00f1036aee748692

  • Size

    296KB

  • Sample

    231207-b8fqdsgfdm

  • MD5

    3e4f74760172468125425ac187cea6bf

  • SHA1

    b5bc61f0823c69201f22dda0d3090667f04f1b93

  • SHA256

    e926c5d122a75a965696115fcb562eeb434009f8520dc911440d06b33532e842

  • SHA512

    32d72dd23f33df75bf35d129d17124a102dfa11fca625c75aebe261bcad0cc14e38fa13a326fb179044cda72a381bbb3d9dd64c85c5ce6de26eb169f183aedc3

  • SSDEEP

    6144:1KcwS4WDY98sZnctnKPk1FeH3cEgMQIVgKPOFtA:1KcwS4WDY9XkKPk18H+M16KOtA

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

4.11

C2

http://shohetrc.com

http://sibcomputer.ru

http://tve-mail.com
Attributes
  • install_dir

    d4dd819322

  • install_file

    Utsysc.exe

  • strings_key

    8419b3024d6f72beef8af6915e592308

  • url_paths

    /forum/index.php

rc4.plain

Targets

    • Target

      75e8dfc1b905f37971df736c6fe18f8a0d952973665bccaa00f1036aee748692

    • Size

      422KB

    • MD5

      b55804bd3be73d762a80a9776b05a2ba

    • SHA1

      e39751d63cc2327fa4800494ad77fb89215231b7

    • SHA256

      75e8dfc1b905f37971df736c6fe18f8a0d952973665bccaa00f1036aee748692

    • SHA512

      88e8539902b7843f0fc9d1e70d362b32681240a357a3ed95007e4916ffe5f8fb27e08750992fec7dd49c8dc299c0bc0aac7eaf648d6ce1a0556d2e2b04b23aed

    • SSDEEP

      6144:ZO9p234i+WDYd8srnc1nKPM1FeH3c4gMQInwxDh:Y9p2x+WDYdXUKPM18H8M1nUDh

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks