General

  • Target

    dc6f3e24ab582489532efa6d9ea40a5af782a315056921068cd7f733788893d6

  • Size

    1.8MB

  • Sample

    240916-fqzg1azfqq

  • MD5

    540f15dcd67c5fd781da538909c2931c

  • SHA1

    4643de9edccae39d6d6d9fc510f546584cf9781c

  • SHA256

    dc6f3e24ab582489532efa6d9ea40a5af782a315056921068cd7f733788893d6

  • SHA512

    775d27296a3d38317325f29263b2ffc2d3c3fae39bc7b0b68930125c8b49eb39697dd26d5c188c7def771ab1327e7e5d479e558b3695414adb1f49dd92837296

  • SSDEEP

    24576:MGNXjgT3QKoO440BE3kUrvaGhPJKYEd4puGP4BQA6eQIT29crHCBOiN27lqh0rmp:MAzg75bXkU1iYbphAmbcrHF97KeeeB

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Targets

    • Target

      dc6f3e24ab582489532efa6d9ea40a5af782a315056921068cd7f733788893d6

    • Size

      1.8MB

    • MD5

      540f15dcd67c5fd781da538909c2931c

    • SHA1

      4643de9edccae39d6d6d9fc510f546584cf9781c

    • SHA256

      dc6f3e24ab582489532efa6d9ea40a5af782a315056921068cd7f733788893d6

    • SHA512

      775d27296a3d38317325f29263b2ffc2d3c3fae39bc7b0b68930125c8b49eb39697dd26d5c188c7def771ab1327e7e5d479e558b3695414adb1f49dd92837296

    • SSDEEP

      24576:MGNXjgT3QKoO440BE3kUrvaGhPJKYEd4puGP4BQA6eQIT29crHCBOiN27lqh0rmp:MAzg75bXkU1iYbphAmbcrHF97KeeeB

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks