General

  • Target

    2025-04-06_6ce20250ab5addfae0903cc0e3d3fb4c_amadey_black-basta_luca-stealer_smoke-loader

  • Size

    2.1MB

  • Sample

    250406-kgg9ksxmx5

  • MD5

    6ce20250ab5addfae0903cc0e3d3fb4c

  • SHA1

    cfea9bc9fc5a5cbbe254e39c9d6a28a9b75d521f

  • SHA256

    04b753f9f181e456ea9ec95c597d32f0e178808d1b204fbe2c370da6659a6a79

  • SHA512

    5e7069b08142e562686971d6da85560ddac6cf66d965040aa6679065ece921b9bd3e976af0402ccc68f3dda0e88f2b20a649a94e45c88007b1128583d8e824ac

  • SSDEEP

    49152:Z/C3aPC2nav7cldn2xvnoWqWZXIvWskzgihOXh5:Z/C3aPO7wavobilv9C

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Targets

    • Target

      2025-04-06_6ce20250ab5addfae0903cc0e3d3fb4c_amadey_black-basta_luca-stealer_smoke-loader

    • Size

      2.1MB

    • MD5

      6ce20250ab5addfae0903cc0e3d3fb4c

    • SHA1

      cfea9bc9fc5a5cbbe254e39c9d6a28a9b75d521f

    • SHA256

      04b753f9f181e456ea9ec95c597d32f0e178808d1b204fbe2c370da6659a6a79

    • SHA512

      5e7069b08142e562686971d6da85560ddac6cf66d965040aa6679065ece921b9bd3e976af0402ccc68f3dda0e88f2b20a649a94e45c88007b1128583d8e824ac

    • SSDEEP

      49152:Z/C3aPC2nav7cldn2xvnoWqWZXIvWskzgihOXh5:Z/C3aPO7wavobilv9C

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.