General

  • Target

    2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459.exe

  • Size

    416KB

  • Sample

    240914-bmhb4ayhnq

  • MD5

    f5d7b79ee6b6da6b50e536030bcc3b59

  • SHA1

    751b555a8eede96d55395290f60adc43b28ba5e2

  • SHA256

    2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

  • SHA512

    532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

  • SSDEEP

    12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

ec08f7

C2

http://185.215.113.26

Attributes
  • install_dir

    054fdc5f70

  • install_file

    Hkbsse.exe

  • strings_key

    783c46f70668d3eed42e83c9f00fc0f5

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Targets

    • Target

      2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459.exe

    • Size

      416KB

    • MD5

      f5d7b79ee6b6da6b50e536030bcc3b59

    • SHA1

      751b555a8eede96d55395290f60adc43b28ba5e2

    • SHA256

      2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

    • SHA512

      532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

    • SSDEEP

      12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Downloads MZ/PE file

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks