amadey | 9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe
Size

3.0MB
MD5

3eedb7ab4ab81081e6fe25b117d4698c
SHA1

20540442599ee9f254f3b7adfe116c2890cd227d
SHA256

9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7
SHA512

5e1426b420c647bed333235763517d91aa6f8b19e52b4d100bb2ad8f1024592e1e82b4c15ed2b4275258fca99b2a71b740c2551200973dbb31bbf7343fd2b58d
SSDEEP

49152:ehsWom5L52gTmt+XMnJO39/34+DCTeenrfQpGHu4HSZWYExaO3s45O7ZdyAbm5NQ:eyPi2gTmtyMJO9/o2CFnTQ2jyZWYExaq

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://5.42.66.29

Attributes

install_dir
f60f0ba310
install_file
Dctooux.exe
strings_key
f34f781563773d1d56ad6459936524d1
url_paths
/b9djjcaSed/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1936	SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe
1936	SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Backdoor.Farfli.2656.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000F20000-0x000000000143C000-memory.dmp

Filesize
5.1MB

Download
memory/1936-1-0x0000000000F20000-0x000000000143C000-memory.dmp

Filesize
5.1MB

Download
memory/1936-2-0x0000000000C00000-0x0000000000C6F000-memory.dmp

Filesize
444KB

Download
memory/1936-4-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/1936-6-0x0000000000C00000-0x0000000000C6F000-memory.dmp

Filesize
444KB

Download
memory/1936-5-0x0000000000F20000-0x000000000143C000-memory.dmp

Filesize
5.1MB

Download