General

  • Target

    7c23cca92ddabc20911e0c51e19b002b.exe

  • Size

    13.4MB

  • Sample

    241216-rrae2stkhq

  • MD5

    7c23cca92ddabc20911e0c51e19b002b

  • SHA1

    f0e07a68ca36681ece42c23d75351d51a9b52a8c

  • SHA256

    471f22db8436b846bcc1b8d9691adb74d02cee7b49e4a58772f486ece4ca19db

  • SHA512

    981afbb497ffde188e5134c181f85870ee1da5b9eb4dfda17e33f1b469a5bf76051071c1f37507c3a9bf1c2abe5c15379f1d2bb457d0953242aaba201fe5c3e1

  • SSDEEP

    196608:cbQLsmUzjxbODbedh49KRAg+89tvjXV9nHTDN0JgCDt0IEM:cbAUsWdlRT+wtrXzzwgCh0Ir

Malware Config

Extracted

Family

amadey

Version

5.10

Botnet

8a680c

C2

http://62.60.226.15

Attributes
  • install_dir

    f39a3c5206

  • install_file

    Gxtuum.exe

  • strings_key

    a1bf8674ebe6a09a1462faf683ebc122

  • url_paths

    /8fj482jd9/index.php

rc4.plain

Targets

    • Target

      7c23cca92ddabc20911e0c51e19b002b.exe

    • Size

      13.4MB

    • MD5

      7c23cca92ddabc20911e0c51e19b002b

    • SHA1

      f0e07a68ca36681ece42c23d75351d51a9b52a8c

    • SHA256

      471f22db8436b846bcc1b8d9691adb74d02cee7b49e4a58772f486ece4ca19db

    • SHA512

      981afbb497ffde188e5134c181f85870ee1da5b9eb4dfda17e33f1b469a5bf76051071c1f37507c3a9bf1c2abe5c15379f1d2bb457d0953242aaba201fe5c3e1

    • SSDEEP

      196608:cbQLsmUzjxbODbedh49KRAg+89tvjXV9nHTDN0JgCDt0IEM:cbAUsWdlRT+wtrXzzwgCh0Ir

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks