amadey

Sharing

Copy URL Twitter E-mail

General

Target
systemenv.bin.zip
Size 22.5MB
Sample250528-r4cqyaxtdw
SHA256 7f458de2c296e05095974afdb4203994899017df91d66a99c86c982123e09bc2
MD5 6c7cb089417e3083944f238dac2f0c2b
SHA1 66bd0a6092faadc3ae1e2fba407a846970de4ba9
SHA512 69d18bab04b78bedd8b899d6253b9b9e9aa4bcc304f63963b84688236f070e6f23a2031b2735c2c40f6756458199f818d4441286f2febb9a803d1463e4050c4f
SSDEEP 393216:x0o3aYCcwc5zADUpK/hKDjzbWzDiG1CPwDvt3uFVCzSq/dVlStgrz005Ll:/XCcwqnK/hKfzbmDpz00Jl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

5.34

Botnet

96e744

Attributes

install_dir
9da1302e6e
install_file
nudwee.exe
strings_key
c9981bea18a00db157dcdb022b5155b7
url_paths
/dash/png/index.php

rc4.plain

Targets

- Target
  MSVCP140.dll
- Size 437KB
- SHA256 654412a50c83d218d9f72f8bbd0e0d2963ed0b58be59d6661e931f32dc9f80d8
- MD5 05f1b8a11885aa248408597f25ee9d47
- SHA1 d73ee3cd3b4a6993f8080211c2d4fdae500cc95d
- SHA512 676bff631cbb503fe3b538ba34d6eccf3f5260e4325dc966c0fe56ca1c5696f8d2e11b4e652610fb031f066c01bb9112d738464d14ae1dc5ef15dab4d766d77f
- SSDEEP 12288:5Cx3l90re/ICEc/pdmFAlG65ndMhUgiW6QR7t5s03Ooc8dHkC2esGd:M390re/ICEIdmFAlZd03Ooc8dHkC2eXd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  VCRUNTIME140.dll
- Size 89KB
- SHA256 63f98f7eb2b42d4e416d1a0e5631becb5ee6ee09393913b4e0d9b4b852355172
- MD5 fd82c7b4ee2c40adaae774d7357426d3
- SHA1 191b79e6a594bbf1ce17df6610f86d05082b36ca
- SHA512 0a80d83e4ce3741378df1bd4115cac15f6e18f1bcfe740afdefd958773e252175a0495ff12ba509840e8b8928cdcfa914c4efe864c3375bca4b8bf86d5cd54b0
- SSDEEP 1536:uPyFWhPlUYIUwiXKdM5Ri1mGWVYpz4hckJc2rElurnjvHkBGCGE7xRTkfSecb6RM:GOWhPyYIUpJGHlMElurn5Roxbecb6DSh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  boost_filesystem.dll
- Size 115KB
- SHA256 ff22a5d2497a2719881cba3ecf02f59813fe525fb19233fb12a5228227e34944
- MD5 0fd14a7ea07f89a705fa1ec3e9ef2cc1
- SHA1 5f6bb56e8e4ed4ad0b215b63e499fbf399f3fab4
- SHA512 9df522a3ba2c4033190157d1e34a2c0e473f42d734f948de26befb4f94bf0812d3c6a5e10d82566fdb2c492a9cdc24bce120740bf719c5f799497cd4e2ac1d07
- SSDEEP 3072:HJeir2OxicXH6F7RpMrBDDQGU5DRKgPFl:peOo2HAIrBryogdl
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  boost_locale.dll
- Size 369KB
- SHA256 1ce12d4c0c3fd8d3c8912fd94ebdf54ff5ff5825c5f3813ce1b3ec6e46d8fd52
- MD5 9ba6713af2927e4b60a9352f8c85fe7d
- SHA1 a96a3abe894129cd64eaefa0992e6e1e48e9a310
- SHA512 ab5c34fbcc2c49e527e3d1e875a1bde104e838330412a932441d57e8ad2649320f20e1512e86ab7428b4cbc1ec0ae5c69929320d6e1eb266e10054b79710b7f2
- SSDEEP 6144:M4elPUOO9W5z76aqKClPU1C9xm6F2o0kcUWgepSYchzbvQje:HJOO90zilPd9EarcUWgepSpIje
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  fmt.dll
- Size 113KB
- SHA256 6c17efa9e1d9cc444d1e2dd72aed7c111f0eea454c34728802a20f167fd6ccad
- MD5 00078f525f333efff7300ef3edb5a2d9
- SHA1 2b4249ceb53d4db2055b898f6a3c609af1d6065d
- SHA512 bcc66e9af1828e9f5d57499a65e6327a8324b7911964533dba67778c081a612e66e4b80cab2bc83a0f336414ee04532a5f4cb43a738328df07cad617c5d4ec3c
- SSDEEP 1536:nboybMWutugZ0PobOG2wzCc+t4I7IoOyZaXuN58Qfp5t2lljbwTbTnFVjE72ItV:HY7zbZ2EoRjh+LwrFVjEF
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  icudt69.dll
- Size 10.5MB
- SHA256 45c40f392da7893aa92ad200ba63560c1b862b87aae8c32bc3f545dbdb58e4cf
- MD5 962afef42974c27d13e28c8bd1172991
- SHA1 614f236132a0c85a314fcc15110df432cef1c6bb
- SHA512 95b65f89c7b5eb1db85f45cd1f1238fc7c270a2908e115954007d0d837313d82dc04e7e6b9b45492be672aae83e461addd213f16bcfb3e56b51ee59d49f11bcf
- SSDEEP 98304:0jFgpAkmqrMY3xAhc2c9DMCqnHlAhrP1JC8crtmP:GFgpFmBGAtAYCqnHlOc5e
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  icuin69.dll
- Size 2.7MB
- SHA256 1bad2711c965cd964c2f2a588a53663e63f1a23fa0e72a9519ac36e542b0c16d
- MD5 116db547209b25eaf4ef2388abb50ee6
- SHA1 9f6833c92f8880066762dc939a910430d4a53c36
- SHA512 9ea8a507eb7ba7da412ebbddaf7fe047ddbffb0f3f4d54ffa9bf8ebfcab8e7d2a56053e0a229dfdf941447cbd0551da884ed7891155065b5682660c988dba760
- SSDEEP 49152:c9wStRh15gJIzgSjFnCO7IHSpAj6u/RFRV8zJgc15b2Dfj/Yt5PlagLfKaKY2hZO:c9wqRf5gJgaRV9ISHYt59aSfpK/hwn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  icuuc69.dll
- Size 1.7MB
- SHA256 c4b335f491a0822d31d43254cfe42c109c5f84bd3f8530beda560cda3e546d77
- MD5 c3b8ac214c04886923d3fcce79438b72
- SHA1 00334e227ab64b9a34c44f9caf5427c4a450d8ea
- SHA512 35b58480e898fac7de69c5f70799ff5899d49c4b789e07580815576c0444f173ef8067d38da74e6419b0cd734f8125c8adb18680603e1a621ed638b9efe2b84a
- SSDEEP 24576:gLGDDp3WxLXyKAYY7cUkawajmwUeI28y+f9DogKEIkkwbPHkSdkfUNEf:gcDB2dY7MarbURZVaenNEf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  libcrypto-3.dll
- Size 2.5MB
- SHA256 3335b1466292fd6d6e13d554e01199461941214f6565fbae82ce54730f49b28c
- MD5 3a0c7e8f0411818f1b6ac3c2365195a3
- SHA1 607f806b46ec505136169676f44df531f11f4412
- SHA512 9ac41fabe207ba643a29d38560a6e3c14b4bb14ab1d0ddf8fb4115882d1ac8805eeeb40a15358b61120e1e35c311384339ce30f1d5ec570ad8ce0b2385ad35db
- SSDEEP 49152:C0wW+EV3pLEUZhytVMBa2FbxH0OK+Txhpr1CPwDvt3uFLBCzTpcKLl1gQ:C0wW2tCBa2Di+Tp1CPwDvt3uFLBCzT0Q
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  libcurl.dll
- Size 361KB
- SHA256 29b5d49e53f4a8cadb2085c1e5c18fa16eb1a1e02d7bf3209378109201a6fb67
- MD5 fa24b81b2a5fa73db503bbfe91f7a854
- SHA1 91a762026b90dcaf31cc28252c94dec80121bba6
- SHA512 cd04e7be2288ffd0dab2c8cf42dba02b42b6bbdd6cf54e23763b904774e03e9a86e8a44c653dd80d2a4f2f2d7651ae86d3ae4a78a103d9459132ececb12f28ca
- SSDEEP 6144:KmlUBftCuZQyCbYo0OVWMXhc8R9l19CYx5GuMOTBQcIl4n4l:Kml+ftCubCbmyS87l19bxQDOTYl
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  libssl-3.dll
- Size 430KB
- SHA256 515d25304515345d67ed45e7fed14b7f547dba013302f8de64fee9e2dc237943
- MD5 705eaf66960e39db680e8582a1f9cccd
- SHA1 518a4c6a57c7b17e9173a763e0c737c702f6509c
- SHA512 5f9f58506ba49e0d99094e3db8fc98ed74e1cc1ad29117707ef4ed1919a0b0fe72c47fcf50053b821d9fb0565eefdb38770746a8760c461c562926a2a3278af7
- SSDEEP 12288:g/DlGinEntnGy9cW7clOeJog7eSB1ux/+nWgstIf7AUcaxW86ljG2iy+9ofH1sK6:klKD7WrydVlSt8pX9q
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  nghttp2.dll
- Size 118KB
- SHA256 793214f2192ff91ce23db55decd0d121126ca4a212cc3cc1b20ccc4381b21d61
- MD5 38cae048eebab137a7005abcd146558a
- SHA1 df2c11dbe3ad3f0addf045e1c16b42a4623bc0ad
- SHA512 afde899d5f3f9370ce1b9aa3fd6b0fecdd66f05c4b776eb81fa5ee9cc7746958277db5eca158f27f6d5b25848c1fcbd24bb972750b278da37d701ac7ca4faebe
- SSDEEP 3072:+AYzkwoAhBm0c8Q6OopxnIsfX6NG8WMqliLcK0XAMef9E2FO:Hwo2mE5rliLcK0XAMeffO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  oneauth.exe
- Size 826KB
- SHA256 44ba08b293958df880adf1e932aa8afcdc6cd0598f600475ac6ac9fe0299ab34
- MD5 ab59ce9a4806633697e02cd7df17e3a0
- SHA1 da0899dac660163934889bbf50773ab6d0664b22
- SHA512 fd9a1c8de26ef594ddc9cd6d19a0b62d700347e89928a99455e84b53838b873bc3b154488628fb986855f1d9c29936264c686df7046cbce778e5b33cfa3ba3f9
- SSDEEP 24576:CtQlSWyNWsDNiBd41q9NAGCKQCwzXMFFsUPh6ockbUt2C:xyCCKQCwkbUt2C
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

amadey 96e744 discovery execution trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Amadey family
  amadey
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral25 behavioral26
- Target
  sqlite3_plex.dll
- Size 646KB
- SHA256 31c9cfe9835a138d06abe5e70f7bd99ab25e308a21e43b526bc808a2156065cf
- MD5 45b0abc0be9d9f66cc060721b834c38a
- SHA1 58a3f2f43a6d85650402ca15e78c94a10276b41d
- SHA512 c1ddea64a17de4eef8c59404722aff7024cecfec274c4d3cab8693a8207c38839b2deabf48f9abe94833b8010fa40f8560128750711981c003f7e2aaafc5fad3
- SSDEEP 12288:D+rEjQRStG+6VGIZbrYVhqhmIO3FqH1JfIdlIEuJVlI+s1zpJZUMmXYgQ04:S4jQRgG+6VZZbcVhsO3FqHrIdxuJVlIv
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral27 behavioral28