General

  • Target

    9c2d4a27b520e44693cd203d4a731846641fad9c8ea05481be863e2951b84041N.exe

  • Size

    213KB

  • Sample

    241119-fj2c1s1enj

  • MD5

    c62cffddd49670b06074bf5f9a30feb0

  • SHA1

    8dfebd1a4285fffbefac18000ad6e5a163a40089

  • SHA256

    9c2d4a27b520e44693cd203d4a731846641fad9c8ea05481be863e2951b84041

  • SHA512

    227255fa9613dd24b4c82366c5b544bee098bb2b6ac5d75c1d485a4a8406ab295a5e200c50c58d9a3f0475f4c0cca81332ff298642f9022328eb71c7cdeb128c

  • SSDEEP

    3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.81

Botnet

f9a925

C2

http://77.91.124.20

Attributes
  • install_dir

    c3912af058

  • install_file

    oneetx.exe

  • strings_key

    0504ce46646b0dc397a3c30d6692ec75

  • url_paths

    /store/games/index.php

rc4.plain

Targets

    • Target

      9c2d4a27b520e44693cd203d4a731846641fad9c8ea05481be863e2951b84041N.exe

    • Size

      213KB

    • MD5

      c62cffddd49670b06074bf5f9a30feb0

    • SHA1

      8dfebd1a4285fffbefac18000ad6e5a163a40089

    • SHA256

      9c2d4a27b520e44693cd203d4a731846641fad9c8ea05481be863e2951b84041

    • SHA512

      227255fa9613dd24b4c82366c5b544bee098bb2b6ac5d75c1d485a4a8406ab295a5e200c50c58d9a3f0475f4c0cca81332ff298642f9022328eb71c7cdeb128c

    • SSDEEP

      3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks