General

  • Target

    59c6eacafceee2fbbff6f0c025f5fdfb358a8b50ba3a58ff2047491c17227a70N

  • Size

    1.8MB

  • Sample

    240927-md1ymaxfkl

  • MD5

    a8900c1f255a11688131b9bf0860a730

  • SHA1

    6067ef527264302b42dd3bf4eca7c5a0f63649be

  • SHA256

    59c6eacafceee2fbbff6f0c025f5fdfb358a8b50ba3a58ff2047491c17227a70

  • SHA512

    e0c1b8128f22d721e5ebabb9c4ac6e58de7875dbce6e8362957f91383446a5f0b737e02be4a12500b170d2c5582d526eeb79cd1fd4e28fa1eef35d3e3af3892b

  • SSDEEP

    49152:S6I/2/qZ8IAmzvmH52WzlcDdb43AtyXtXaHr+51V:S6I+c85mzvmZLlcDZLyX5

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Targets

    • Target

      59c6eacafceee2fbbff6f0c025f5fdfb358a8b50ba3a58ff2047491c17227a70N

    • Size

      1.8MB

    • MD5

      a8900c1f255a11688131b9bf0860a730

    • SHA1

      6067ef527264302b42dd3bf4eca7c5a0f63649be

    • SHA256

      59c6eacafceee2fbbff6f0c025f5fdfb358a8b50ba3a58ff2047491c17227a70

    • SHA512

      e0c1b8128f22d721e5ebabb9c4ac6e58de7875dbce6e8362957f91383446a5f0b737e02be4a12500b170d2c5582d526eeb79cd1fd4e28fa1eef35d3e3af3892b

    • SSDEEP

      49152:S6I/2/qZ8IAmzvmH52WzlcDdb43AtyXtXaHr+51V:S6I+c85mzvmZLlcDZLyX5

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks