General

  • Target

    v7144898.exe

  • Size

    234KB

  • Sample

    250127-m1xvgswmfn

  • MD5

    56584930533091ccb7453a21ef2ac0ad

  • SHA1

    dcaa8c6b270bd9685642ebb7ad1ec9747e259446

  • SHA256

    0e0372526bfe3a43d8dc3cb8af10f60914ccacd20597189b54f7c38e317e0bdb

  • SHA512

    fe89c28131efdf309c518340d59890f8568a28c7c7b3deec30c5972917e38a7b65ee678e0bc933e002d7496906b35e75206f5e497174bcb2ee475c0057e04bc8

  • SSDEEP

    6144:KSy+bnr+zp0yN90QEOAIUzh/pwXps8zbC:WMrry909/mXps8zbC

Malware Config

Extracted

Family

amadey

Version

3.86

Botnet

88c8bb

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Targets

    • Target

      v7144898.exe

    • Size

      234KB

    • MD5

      56584930533091ccb7453a21ef2ac0ad

    • SHA1

      dcaa8c6b270bd9685642ebb7ad1ec9747e259446

    • SHA256

      0e0372526bfe3a43d8dc3cb8af10f60914ccacd20597189b54f7c38e317e0bdb

    • SHA512

      fe89c28131efdf309c518340d59890f8568a28c7c7b3deec30c5972917e38a7b65ee678e0bc933e002d7496906b35e75206f5e497174bcb2ee475c0057e04bc8

    • SSDEEP

      6144:KSy+bnr+zp0yN90QEOAIUzh/pwXps8zbC:WMrry909/mXps8zbC

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender DisableAntiSpyware settings

    • Modifies Windows Defender Real-time Protection settings

    • Modifies Windows Defender TamperProtection settings

    • Modifies Windows Defender notification settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.