amadey | 774a350a1aed1ad5ef9d4165673d8cdb80d0920c2ae9746332d56b146b5bcd5e

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_f52cadecf11a41af1402009921a61b13_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 472KB
Sample260729-mexmlatvfs
SHA256 774a350a1aed1ad5ef9d4165673d8cdb80d0920c2ae9746332d56b146b5bcd5e
MD5 f52cadecf11a41af1402009921a61b13
SHA1 cc31472111b38864e2c0e1086a0e911d09ec008a
SHA512 3333be2020e66aa93e0e5e9df5839b3b239dfdfd84531e443c4ad193095ca9318942d2ffc4780930d9d3312380c63065602f64fb088f51241c38904c23ebc04a
SSDEEP 6144:8HF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHJsAyuWZGUU/Sdfy9103T7fm14AO5kj:8HF0VKkWrb4QDwR4QWdyJsAlWZBV7qMK
TLSH
T192A44B217812C032D66191721FB9FFF585ADB8259B7109DB7BC0CF7699202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fbf543 discovery amadey trojan

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3444-0-0x0000000000400000-0x0000000000476000-memory.dmp	family_amadey_v2
behavioral2/memory/3444-1-0x0000000000400000-0x0000000000476000-memory.dmp	family_amadey_v2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	3444	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_f52cadecf11a41af1402009921a61b13_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_f52cadecf11a41af1402009921a61b13_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_f52cadecf11a41af1402009921a61b13_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 520
  2⤵
  - Program crash
  PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3444 -ip 3444
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3444-0-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/3444-1-0x0000000000400000-0x0000000000476000-memory.dmp