Overview

overview

10

Static

static

1

file.exe

windows7-x64

7

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.exe
  • Size 595KB
  • Sample240202-aebc5sbegm
  • SHA256 7c94846904eeffd843980d64ba0eee3b8a81a52aeb60b5a5195bf7b426e4a443
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeytrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.17

C2

  • http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Targets

    • Target
      file.exe
    • Size 595KB
    • SHA256 7c94846904eeffd843980d64ba0eee3b8a81a52aeb60b5a5195bf7b426e4a443
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks