amadey | 4e4b12ecc826ca8d04bdab5338a2d7d779242a1782283ea8a17d57bce95cdd85

General

Target
a06ca2f848c977ba268366038cfbe8f696c0e25424001ff9cff2271c5a16a258.zip
Size 1.7MB
Sample260729-t3dmyszxft
SHA256 4e4b12ecc826ca8d04bdab5338a2d7d779242a1782283ea8a17d57bce95cdd85
MD5 c42e33232362976be9f837a93310ee82
SHA1 5fac307434dbab25a1680a8c44849b3243a9c16f
SHA512 48f449c2f1f1452280946afc36e32f87733e35e43bc6b7c15afaf55c7ba189128a2783ccaa8ab8d9ec343a7eb8ccab15cc9d18d4cd7b19fe5c763c05960e1704
SSDEEP 49152:L9Q1yROUkHW4QfojOvOgPnUGnXze99hEu1uxqET2:L9RRO7WMHmnUGXzejlgxFT2
TLSH
T18C853381031F7CE445E82CEE9AF39CE4558AA0F577C5160349871E3B2A8F69FF6314A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

5.78

C2

http://91.92.242.236

Attributes

install_dir
adb7f46c0c
install_file
Bwale.exe
strings_key
a42cf94a609810d038dd0ca0d030ffef
url_paths
/oPvjr94jfe/index.php

rc4.plain

Targets

- Target
  a06ca2f848c977ba268366038cfbe8f696c0e25424001ff9cff2271c5a16a258.zip
- Size 1.7MB
- SHA256 4e4b12ecc826ca8d04bdab5338a2d7d779242a1782283ea8a17d57bce95cdd85
- MD5 c42e33232362976be9f837a93310ee82
- SHA1 5fac307434dbab25a1680a8c44849b3243a9c16f
- SHA512 48f449c2f1f1452280946afc36e32f87733e35e43bc6b7c15afaf55c7ba189128a2783ccaa8ab8d9ec343a7eb8ccab15cc9d18d4cd7b19fe5c763c05960e1704
- SSDEEP 49152:L9Q1yROUkHW4QfojOvOgPnUGnXze99hEu1uxqET2:L9RRO7WMHmnUGXzejlgxFT2
- TLSH
  T18C853381031F7CE445E82CEE9AF39CE4558AA0F577C5160349871E3B2A8F69FF6314A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  a06ca2f848c977ba268366038cfbe8f696c0e25424001ff9cff2271c5a16a258.exe
- Size 2.8MB
- SHA256 a06ca2f848c977ba268366038cfbe8f696c0e25424001ff9cff2271c5a16a258
- MD5 02ca9583237646ba46c8699ff8ee6ff0
- SHA1 02572cbf8264c437758d834c0aa5409b941aa353
- SHA512 bed7c65d808daff40696da6681dc86d749621836b1598a490fe10754d23cbd0d10384ba81f95015936655fdd8c2e58c556e23bf0850f2c484b2ded85c1964efb
- SSDEEP 49152:3x7UsX7w1ZeuIpQxnG1cVT3YOzKKFbW81XxznCI:3x7zLwOuIpQNG1ATAKJ11Xx2I
- TLSH
  T197D52B203BEE6198F2777E36D7E67595DBAFB3722A06CD8B1001434B0652902DE87D39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery amadey trojan
- Detects Amadey x86-bit Payload
- Family: Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral2