amadey | 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7 | Triage

Sharing

General

Target

6cfddd5ce9ca4bb209bd5d8c2cd80025.exe
Size

8.6MB
Sample

240617-gvbgea1grq
MD5

6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1

424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256

376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512

d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8
SSDEEP

98304:kHRNlpNpt3gSuDdFeznbkRBLwX1Pgedmv72Im/xAgDXMnw4bmVKAHNAXqcMHKYsN:uRrptYDdF8komd8xAUXMwIwHNvcMmN

Score

10^/10

amadey ffb1b9 trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

ffb1b9

C2

http://proresupdate.com

Attributes

install_dir
4bbb72a446
install_file
Hkbsse.exe
strings_key
1ebbd218121948a356341fff55521237
url_paths
/h9fmdW5/index.php

rc4.plain

Targets

- Target
  
  6cfddd5ce9ca4bb209bd5d8c2cd80025.exe
- Size
  
  8.6MB
- MD5
  
  6cfddd5ce9ca4bb209bd5d8c2cd80025
- SHA1
  
  424da82e9edbb6b39a979ab97d84239a1d67c48b
- SHA256
  
  376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
- SHA512
  
  d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8
- SSDEEP
  
  98304:kHRNlpNpt3gSuDdFeznbkRBLwX1Pgedmv72Im/xAgDXMnw4bmVKAHNAXqcMHKYsN:uRrptYDdF8komd8xAUXMwIwHNvcMmN
Score

10^/10

amadey ffb1b9 trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

amadeyffb1b9trojan

behavioral2

amadeyffb1b9trojan