amadey | ccf857cc1b2fd163caba4b42a0def2d1b3169a5cbe52d6e4f9313aadb1a6f34c | Triage

Sharing

General

Target

4860-329-0x0000000000630000-0x0000000000AE8000-memory.dmp
Size

4.7MB
Sample

240329-jf3cpace5s
MD5

e5a2a8aea253eeb1df49f90ccff4cb37
SHA1

c95c956122ab644b25b1396bfd725317945cf404
SHA256

ccf857cc1b2fd163caba4b42a0def2d1b3169a5cbe52d6e4f9313aadb1a6f34c
SHA512

e8af7615b77c95bda418c5d7fe6d36311b788c92c6c9805f45d2f3e71bde559f11897e07d7fbdb144d6642d21ace28c5653e04a4ebfd002e7e12ee33ea577252
SSDEEP

98304:2SXmFY7R/TUYspWDDDapql4WdK7I1lQ3wpczj33j+E:LilOx1hWjHyE

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Targets

- Target
  
  4860-329-0x0000000000630000-0x0000000000AE8000-memory.dmp
- Size
  
  4.7MB
- MD5
  
  e5a2a8aea253eeb1df49f90ccff4cb37
- SHA1
  
  c95c956122ab644b25b1396bfd725317945cf404
- SHA256
  
  ccf857cc1b2fd163caba4b42a0def2d1b3169a5cbe52d6e4f9313aadb1a6f34c
- SHA512
  
  e8af7615b77c95bda418c5d7fe6d36311b788c92c6c9805f45d2f3e71bde559f11897e07d7fbdb144d6642d21ace28c5653e04a4ebfd002e7e12ee33ea577252
- SSDEEP
  
  98304:2SXmFY7R/TUYspWDDDapql4WdK7I1lQ3wpczj33j+E:LilOx1hWjHyE
Score

10^/10

amadey trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2