amadey | x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b[.]exe

General

Target
x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe
Size 219KB
Sample260603-b6eejsf19t
SHA256 24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b
MD5 6d2986b35b956934c2594c6f543ef21e
SHA1 22cfc60a3799a183c4129458db649311887db98d
SHA512 e31783e02fa8462b7c8d4104cdde17572e350b7679ad0793fb22debf415688b3ad6f6a95346f6f57ca7e0bb88f137242c07035a3e426087c65bcb464036c0740
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
TLSH
T1FE24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fb0fb8 trojan amadey

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

C2

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
sample	family_amadey_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe

File Explorer

x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe

.exe 219KB

x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe

IMPHASH 3865972614d44e518713c9a6183fed14
SHA256 24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b
MD5 6d2986b35b956934c2594c6f543ef21e
SHA1 22cfc60a3799a183c4129458db649311887db98d
SHA512 e31783e02fa8462b7c8d4104cdde17572e350b7679ad0793fb22debf415688b3ad6f6a95346f6f57ca7e0bb88f137242c07035a3e426087c65bcb464036c0740
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
TLSH
T1FE24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Amadey x86-bit Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

83249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Mktmp\Amadey\Release\Amadey.pdb

kernel32

CreateFileA CloseHandle GetSystemInfo CreateThread GetThreadContext GetProcAddress VirtualAllocEx RemoveDirectoryA GetFileAttributesA CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetLastError CopyFileA GetTempPathA Sleep GetModuleHandleA SetCurrentDirectoryA ResumeThread GetComputerNameExW GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree WriteProcessMemory GetModuleFileNameA ReadProcessMemory ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RaiseException SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc MultiByteToWideChar CompareStringW LCMapStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA GetSidIdentifierAuthority

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing