amadey | bc6db35f4e55a0b1f7d718791db3f1940d2eab29f9c6d411bb5b39c8641aca06 | Triage

Sharing

General

Target

bc6db35f4e55a0b1f7d718791db3f1940d2eab29f9c6d411bb5b39c8641aca06
Size

235KB
Sample

231211-r19w9saha3
MD5

7dd74bf20c448618bcb3464967d4ef64
SHA1

dfbb3b316c70625c9d8a1e32a0968823f2b6ef16
SHA256

bc6db35f4e55a0b1f7d718791db3f1940d2eab29f9c6d411bb5b39c8641aca06
SHA512

7eaca13bdc013752ceb2e0e641fbf02acd4ee916cb9e5e5e078ca3d9917ab3bb1a81086d43ddd03485aa6ce73f89b6bb6dde8b4a88ba501bae48f6b6b4117a73
SSDEEP

6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Targets

- Target
  
  bc6db35f4e55a0b1f7d718791db3f1940d2eab29f9c6d411bb5b39c8641aca06
- Size
  
  235KB
- MD5
  
  7dd74bf20c448618bcb3464967d4ef64
- SHA1
  
  dfbb3b316c70625c9d8a1e32a0968823f2b6ef16
- SHA256
  
  bc6db35f4e55a0b1f7d718791db3f1940d2eab29f9c6d411bb5b39c8641aca06
- SHA512
  
  7eaca13bdc013752ceb2e0e641fbf02acd4ee916cb9e5e5e078ca3d9917ab3bb1a81086d43ddd03485aa6ce73f89b6bb6dde8b4a88ba501bae48f6b6b4117a73
- SSDEEP
  
  6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2