Overview

overview

10

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8a796a28609420f6c5caab1b496aa0a4b292bbf6bbd1a0cc0a00d23efc1f6d60
  • Size 245KB
  • Sample240213-ffygysbe41
  • SHA256 8a796a28609420f6c5caab1b496aa0a4b292bbf6bbd1a0cc0a00d23efc1f6d60
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeysmokeloaderpub3backdoortrojan

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • pub3

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://sjyey.com/tmp/index.php

  • http://babonwo.ru/tmp/index.php

  • http://mth.com.ua/tmp/index.php

  • http://piratia.pw/tmp/index.php

  • http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32

Extracted

Family

  • amadey

Version

  • 4.14

C2

  • http://anfesq.com

  • http://cbinr.com

  • http://rimakc.ru

Attributes
  • install_dir

    68fd3d7ade

  • install_file

    Utsysc.exe

  • strings_key

    27ec7fd6f50f63b8af0c1d3deefcc8fe

  • url_paths

    /forum/index.php

rc4.plain

Targets

    • Target
      8a796a28609420f6c5caab1b496aa0a4b292bbf6bbd1a0cc0a00d23efc1f6d60
    • Size 245KB
    • SHA256 8a796a28609420f6c5caab1b496aa0a4b292bbf6bbd1a0cc0a00d23efc1f6d60
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    amadeysmokeloaderpub3backdoortrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks