General

  • Target

    a31582a630a1e2bb4d94f61dd3756e5beb723e1ac77a7e8617a7b86e4f67dd84

  • Size

    212KB

  • Sample

    241110-bkr4hsvqfw

  • MD5

    dd3b85beecf23e8790f127c176d30252

  • SHA1

    5543c53c51cece0fca022eb0eda4c30b3f43eda0

  • SHA256

    a31582a630a1e2bb4d94f61dd3756e5beb723e1ac77a7e8617a7b86e4f67dd84

  • SHA512

    58d58a825ac6a154b0749b45fc356ce9595afef1d87ea894d09d3afb39d5f48f9f591573089d213dc3e9f7cc58bfafdd8882cf3b0e80569bdbe397749c71cf3e

  • SSDEEP

    3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq

Malware Config

Extracted

Family

amadey

Version

3.81

Botnet

f9a925

C2

http://77.91.124.20

Attributes
  • install_dir

    c3912af058

  • install_file

    oneetx.exe

  • strings_key

    0504ce46646b0dc397a3c30d6692ec75

  • url_paths

    /store/games/index.php

rc4.plain

Targets

    • Target

      a31582a630a1e2bb4d94f61dd3756e5beb723e1ac77a7e8617a7b86e4f67dd84

    • Size

      212KB

    • MD5

      dd3b85beecf23e8790f127c176d30252

    • SHA1

      5543c53c51cece0fca022eb0eda4c30b3f43eda0

    • SHA256

      a31582a630a1e2bb4d94f61dd3756e5beb723e1ac77a7e8617a7b86e4f67dd84

    • SHA512

      58d58a825ac6a154b0749b45fc356ce9595afef1d87ea894d09d3afb39d5f48f9f591573089d213dc3e9f7cc58bfafdd8882cf3b0e80569bdbe397749c71cf3e

    • SSDEEP

      3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks