amadey | 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459 | Triage

Sharing

General

Target

2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
Size

416KB
Sample

240829-2g3zqawgkl
MD5

f5d7b79ee6b6da6b50e536030bcc3b59
SHA1

751b555a8eede96d55395290f60adc43b28ba5e2
SHA256

2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512

532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP

12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco

Score

10^/10

amadey ec08f7 discovery trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

ec08f7

C2

http://185.215.113.26

Attributes

install_dir
054fdc5f70
install_file
Hkbsse.exe
strings_key
783c46f70668d3eed42e83c9f00fc0f5
url_paths
/Dem7kTu/index.php

rc4.plain

Targets

- Target
  
  2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
- Size
  
  416KB
- MD5
  
  f5d7b79ee6b6da6b50e536030bcc3b59
- SHA1
  
  751b555a8eede96d55395290f60adc43b28ba5e2
- SHA256
  
  2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
- SHA512
  
  532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
- SSDEEP
  
  12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
Score

10^/10

amadey ec08f7 discovery trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeyec08f7discoverytrojan

behavioral2