General

  • Target

    b84341e84bc047945fd71203d0d2b6c725ce6a3c010039f02ef49b8b607ec4ba.exe

  • Size

    206KB

  • Sample

    241117-p8kw1azhme

  • MD5

    98d0c55006cce41a19d35b43cc437d2b

  • SHA1

    41139f4ccfdf458579a0c573217e1c68fa180a94

  • SHA256

    b84341e84bc047945fd71203d0d2b6c725ce6a3c010039f02ef49b8b607ec4ba

  • SHA512

    bd47d6738c3e977c9a863164cd3b2d495a5e15d32ab57e6fd70ffadb1442e30e0ede0d7003ee9743d16da43112f9aae80b87dcf090a40ee18ac38097f3196333

  • SSDEEP

    3072:c/frTDzurT1S3CzpdmnATE55zjExkKGruONMvhu5QTXzeJX2vkMfSDPwUH:Wfrnzurs3Czpexj2kGOIu5QTyJMKk2

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Targets

    • Target

      b84341e84bc047945fd71203d0d2b6c725ce6a3c010039f02ef49b8b607ec4ba.exe

    • Size

      206KB

    • MD5

      98d0c55006cce41a19d35b43cc437d2b

    • SHA1

      41139f4ccfdf458579a0c573217e1c68fa180a94

    • SHA256

      b84341e84bc047945fd71203d0d2b6c725ce6a3c010039f02ef49b8b607ec4ba

    • SHA512

      bd47d6738c3e977c9a863164cd3b2d495a5e15d32ab57e6fd70ffadb1442e30e0ede0d7003ee9743d16da43112f9aae80b87dcf090a40ee18ac38097f3196333

    • SSDEEP

      3072:c/frTDzurT1S3CzpdmnATE55zjExkKGruONMvhu5QTXzeJX2vkMfSDPwUH:Wfrnzurs3Czpexj2kGOIu5QTyJMKk2

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks