Overview

overview

10

Static

static

10

1548-3-0x0...ry.exe

windows7-x64

10

1548-3-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1548-3-0x0000000000AC0000-0x0000000000F81000-memory.dmp

  • Size

    4.8MB

  • Sample

    241105-bnd13asblm

  • MD5

    a2025af7f5b779021efff9dc16fd8f25

  • SHA1

    ecc5b5fcc99f3a39c7c977506bc96d4d3cee2d8d

  • SHA256

    d8ad3fcf0c3b3891808985275338dfa8f7b8e464608582de8418cfdc528c70bb

  • SHA512

    17436e5c4d36a7db0cf9c33721de3e8c316f39855f6ef7ecf0c7620a295bad9539a95d9002de3bb0ab9b419c8b0dcd3c2dd1f1db94ed842eeb2cd48eb88337be

  • SSDEEP

    98304:W69nvdGRsXOzwdofwiI242p232H7WqzKipAORD3:WKv242BHwsD3

Score
10/10
amadeyfed3aatrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Targets

    • Target

      1548-3-0x0000000000AC0000-0x0000000000F81000-memory.dmp

    • Size

      4.8MB

    • MD5

      a2025af7f5b779021efff9dc16fd8f25

    • SHA1

      ecc5b5fcc99f3a39c7c977506bc96d4d3cee2d8d

    • SHA256

      d8ad3fcf0c3b3891808985275338dfa8f7b8e464608582de8418cfdc528c70bb

    • SHA512

      17436e5c4d36a7db0cf9c33721de3e8c316f39855f6ef7ecf0c7620a295bad9539a95d9002de3bb0ab9b419c8b0dcd3c2dd1f1db94ed842eeb2cd48eb88337be

    • SSDEEP

      98304:W69nvdGRsXOzwdofwiI242p232H7WqzKipAORD3:WKv242BHwsD3

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Amadey family

      amadey
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks