Overview

overview

10

Static

static

1

b (1).hta

windows7-x64

6

b (1).hta

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b (1).cod

  • Size

    67KB

  • Sample

    240909-th2t2syhqd

  • MD5

    efdae93cb31dc54c3d87779cd4492a66

  • SHA1

    28e7c6c449170c4f64b660dfa83049e34cea5c06

  • SHA256

    b48b6b38768b5e6003b7c9412f3aeeb0bf74126f01e356691b7508c13a1b7e68

  • SHA512

    8192f1eb0b3147fb6f01b369c9d67904c0a19168a512d8f6414822cdaa2da01ec322d7c8e3a105e897fb33c0150e195f1e2584c31ce84aa7a367d50454f9c091

  • SSDEEP

    1536:KSe9JyrL3EZo/3mgZgqS2P/kPERYSGZ9hJbqbo+UKfy5R9q4sIhuS7:s9JMLTy5jq0h97

Score
10/10
amadeydiscoveryexecutiontrojan

Malware Config

Targets

    • Target

      b (1).cod

    • Size

      67KB

    • MD5

      efdae93cb31dc54c3d87779cd4492a66

    • SHA1

      28e7c6c449170c4f64b660dfa83049e34cea5c06

    • SHA256

      b48b6b38768b5e6003b7c9412f3aeeb0bf74126f01e356691b7508c13a1b7e68

    • SHA512

      8192f1eb0b3147fb6f01b369c9d67904c0a19168a512d8f6414822cdaa2da01ec322d7c8e3a105e897fb33c0150e195f1e2584c31ce84aa7a367d50454f9c091

    • SSDEEP

      1536:KSe9JyrL3EZo/3mgZgqS2P/kPERYSGZ9hJbqbo+UKfy5R9q4sIhuS7:s9JMLTy5jq0h97

    Score
    10/10
    discoveryexecutionamadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks