amadey | 2fb68ae2af48ecc56a22ea3ffb48c8b236ce197255d05e64b73ce5ffa66fa3fa

General

Target
2026-07-30_c2b5d32dbdd72d4adf5e629ed74db2a1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 472KB
Sample260730-ls4sdsfc75
SHA256 2fb68ae2af48ecc56a22ea3ffb48c8b236ce197255d05e64b73ce5ffa66fa3fa
MD5 c2b5d32dbdd72d4adf5e629ed74db2a1
SHA1 235ce1809cfe43a5c56a59064d3060a313dae9e7
SHA512 86b68a87a8776b7103d4589060e081e5af3bf78e1b8cdd9dbdce7016b98936bc21e7c6b46453d733dd78aa0ead9c8aad8085156ff889e7fb456e23db47cb93ff
SSDEEP 6144:8HF0VK/Wrb4QC1uwYV3ohQU1d+/mb9p+VHgsAyuWZGU8/Sdfy9103T7fmz4AO5k6:8HF0VK/Wrb4QDwM4QWdEgsAlWZBnMqM8
TLSH
T192A46C117917D033CA6291711E6DEFF584ADB8259B7109CB7BC0CF7A99201E26A31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

C2

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Targets

- Target
  2026-07-30_c2b5d32dbdd72d4adf5e629ed74db2a1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
- Size 472KB
- SHA256 2fb68ae2af48ecc56a22ea3ffb48c8b236ce197255d05e64b73ce5ffa66fa3fa
- MD5 c2b5d32dbdd72d4adf5e629ed74db2a1
- SHA1 235ce1809cfe43a5c56a59064d3060a313dae9e7
- SHA512 86b68a87a8776b7103d4589060e081e5af3bf78e1b8cdd9dbdce7016b98936bc21e7c6b46453d733dd78aa0ead9c8aad8085156ff889e7fb456e23db47cb93ff
- SSDEEP 6144:8HF0VK/Wrb4QC1uwYV3ohQU1d+/mb9p+VHgsAyuWZGU8/Sdfy9103T7fmz4AO5k6:8HF0VK/Wrb4QDwM4QWdEgsAlWZBnMqM8
- TLSH
  T192A46C117917D033CA6291711E6DEFF584ADB8259B7109CB7BC0CF7A99201E26A31F3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

fbf543 discovery amadey trojan
- Detects Amadey x86-bit Payload
- Family: Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Amadey x86-bit Payload

Family: Amadey

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2