Overview

overview

10

Static

static

1

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    1.8MB

  • Sample

    240331-j8zghagf4z

  • MD5

    97256cf11c9109c24fde65395fef1306

  • SHA1

    e60278d8383912f03f25e3f92bf558e2a33f229d

  • SHA256

    21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

  • SHA512

    41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e

  • SSDEEP

    24576:rGpVQOAoqyDshVag6Vu4luUR/oF1av5H/BNMVMmFTMqITdpE4bTJ5/kOG01N74:rBoqyDBVZAoCyQzITdpBvJ5U01K

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://185.172.128.3

Attributes
  • install_dir

    One_Dragon_Center

  • install_file

    MSI.CentralServer.exe

  • strings_key

    fd2f5851d3165c210396dcbe9930d294

  • url_paths

    /QajE3OBS/index.php

rc4.plain

Targets

    • Target

      tmp

    • Size

      1.8MB

    • MD5

      97256cf11c9109c24fde65395fef1306

    • SHA1

      e60278d8383912f03f25e3f92bf558e2a33f229d

    • SHA256

      21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

    • SHA512

      41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e

    • SSDEEP

      24576:rGpVQOAoqyDshVag6Vu4luUR/oF1av5H/BNMVMmFTMqITdpE4bTJ5/kOG01N74:rBoqyDBVZAoCyQzITdpBvJ5U01K

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks