Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a7eb1768c065d68288aeaeeb0593792b75079808f310f3dab921323e6c85b1b

  • Size

    397KB

  • Sample

    240619-11btxatfkg

  • MD5

    49424674de93a3cb442fe160dfb6df59

  • SHA1

    7ff555f0a50d710c38aa97866d738886a80c22cd

  • SHA256

    1a7eb1768c065d68288aeaeeb0593792b75079808f310f3dab921323e6c85b1b

  • SHA512

    57764e4a8bd9773b107fc706068234ba8377c1563e49e73d27ab7724f4452189d89f6661e8185311c5e693fc6a1d3994171cf9df8a26622aa8e504e0b6bcc297

  • SSDEEP

    6144:k/j4nF0JBz6uVjkR6R+64rSALR8+lyEinZu4MeCX+H+yTs+vTo7O/JcH:kkF0fzWIR+tinIw++H+aWH

Score
10/10
amadey8fc809trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

C2

http://nudump.com

http://otyt.ru

http://selltix.org
Attributes
  • install_dir

    b739b37d80

  • install_file

    Dctooux.exe

  • strings_key

    65bac8d4c26069c29f1fd276f7af33f3

  • url_paths

    /forum/index.php

    /forum2/index.php

    /forum3/index.php

rc4.plain

Targets

    • Target

      1a7eb1768c065d68288aeaeeb0593792b75079808f310f3dab921323e6c85b1b

    • Size

      397KB

    • MD5

      49424674de93a3cb442fe160dfb6df59

    • SHA1

      7ff555f0a50d710c38aa97866d738886a80c22cd

    • SHA256

      1a7eb1768c065d68288aeaeeb0593792b75079808f310f3dab921323e6c85b1b

    • SHA512

      57764e4a8bd9773b107fc706068234ba8377c1563e49e73d27ab7724f4452189d89f6661e8185311c5e693fc6a1d3994171cf9df8a26622aa8e504e0b6bcc297

    • SSDEEP

      6144:k/j4nF0JBz6uVjkR6R+64rSALR8+lyEinZu4MeCX+H+yTs+vTo7O/JcH:kkF0fzWIR+tinIw++H+aWH

    Score
    10/10
    amadey8fc809trojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks