Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29-01-2024 02:23
General
-
Target
SecuriteInfo.com.BScope.Backdoor.Farfli.2656.4301.exe
-
Size
3.0MB
-
MD5
3eedb7ab4ab81081e6fe25b117d4698c
-
SHA1
20540442599ee9f254f3b7adfe116c2890cd227d
-
SHA256
9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7
-
SHA512
5e1426b420c647bed333235763517d91aa6f8b19e52b4d100bb2ad8f1024592e1e82b4c15ed2b4275258fca99b2a71b740c2551200973dbb31bbf7343fd2b58d
-
SSDEEP
49152:ehsWom5L52gTmt+XMnJO39/34+DCTeenrfQpGHu4HSZWYExaO3s45O7ZdyAbm5NQ:eyPi2gTmtyMJO9/o2CFnTQ2jyZWYExaq
Score
10/10
Malware Config
Extracted
Family
amadey
Version
4.17
C2
http://5.42.66.29
Attributes
-
install_dir
f60f0ba310
-
install_file
Dctooux.exe
-
strings_key
f34f781563773d1d56ad6459936524d1
-
url_paths
/b9djjcaSed/index.php
rc4.plain
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Backdoor.Farfli.2656.4301.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Backdoor.Farfli.2656.4301.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
444KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
444KB