Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e9bcb3fcdedd982630b53e0ec84eefd0c7dbb9e22a4fd6de1168e7f5e166defd

  • Size

    4.5MB

  • Sample

    240526-qcd91sfh89

  • MD5

    2505c6f2331cfc6d1a74b7009ecb41ea

  • SHA1

    67fe99c67d3aeb351d2cef54ba352a328db65433

  • SHA256

    e9bcb3fcdedd982630b53e0ec84eefd0c7dbb9e22a4fd6de1168e7f5e166defd

  • SHA512

    7b1ffcdb8a6300c62bffd62b4bad3aabc24bbb67e40b95ad197fb662b72a363af1c67d6422def2f837ac6297918ebc222c907c73dcc67c7b130c0a47379fd611

  • SSDEEP

    98304:cfUb8pAxsOBSexdGzByOahalkaX7EgPHx8lPw2GiqVGf2s7x9tMOmf:cfU+OsvwoYOau3gosPbk4f/bo

Score
10/10
amadey8fc809trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

C2

http://nudump.com

http://otyt.ru

http://selltix.org
Attributes
  • install_dir

    b739b37d80

  • install_file

    Dctooux.exe

  • strings_key

    65bac8d4c26069c29f1fd276f7af33f3

  • url_paths

    /forum/index.php

    /forum2/index.php

    /forum3/index.php

rc4.plain

Targets

    • Target

      e9bcb3fcdedd982630b53e0ec84eefd0c7dbb9e22a4fd6de1168e7f5e166defd

    • Size

      4.5MB

    • MD5

      2505c6f2331cfc6d1a74b7009ecb41ea

    • SHA1

      67fe99c67d3aeb351d2cef54ba352a328db65433

    • SHA256

      e9bcb3fcdedd982630b53e0ec84eefd0c7dbb9e22a4fd6de1168e7f5e166defd

    • SHA512

      7b1ffcdb8a6300c62bffd62b4bad3aabc24bbb67e40b95ad197fb662b72a363af1c67d6422def2f837ac6297918ebc222c907c73dcc67c7b130c0a47379fd611

    • SSDEEP

      98304:cfUb8pAxsOBSexdGzByOahalkaX7EgPHx8lPw2GiqVGf2s7x9tMOmf:cfU+OsvwoYOau3gosPbk4f/bo

    Score
    10/10
    amadey8fc809trojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks