amadey

General

Target

49b2e70aea9d43c385348559c535402849cc2d17f777491318e984a803952d9e
Size

1.6MB
Sample

240521-179phscb58
MD5

18b01b395414f9e1108aa08e0c12fc21
SHA1

b96c252cfff68e7a8af09b02770b44010584eb78
SHA256

49b2e70aea9d43c385348559c535402849cc2d17f777491318e984a803952d9e
SHA512

61a7855cc9cb9ecba8435d9c73d676ccbc6d3fb828c7b73fd7c696bf0d06f7fc8fe64188d54d87ffb35b16393b39ecf1f85596c811eb717e4b49aae8fbae0963
SSDEEP

49152:XlErwK1a3W4u1+ZA/WbBPlB8huaDa2nv+4PEknY:SrwKo3lu+yujIuaDaYPP3Y

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes

install_dir
908f070dff
install_file
explorku.exe
strings_key
b25a9385246248a95c600f9a061438e1
url_paths
/go34ko8/index.php

rc4.plain

Targets

- Target
  
  49b2e70aea9d43c385348559c535402849cc2d17f777491318e984a803952d9e
- Size
  
  1.6MB
- MD5
  
  18b01b395414f9e1108aa08e0c12fc21
- SHA1
  
  b96c252cfff68e7a8af09b02770b44010584eb78
- SHA256
  
  49b2e70aea9d43c385348559c535402849cc2d17f777491318e984a803952d9e
- SHA512
  
  61a7855cc9cb9ecba8435d9c73d676ccbc6d3fb828c7b73fd7c696bf0d06f7fc8fe64188d54d87ffb35b16393b39ecf1f85596c811eb717e4b49aae8fbae0963
- SSDEEP
  
  49152:XlErwK1a3W4u1+ZA/WbBPlB8huaDa2nv+4PEknY:SrwKo3lu+yujIuaDaYPP3Y
Score

10^/10

amadey 18befc evasion themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects executables packed with Themida
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects executables packed with Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2