Overview

overview

10

Static

static

3

b649944f79...c1.exe

windows10-ltsc_2021-x64

10

Resubmissions

17/08/2026, 03:48

260817-ec4dcssgla10

27/04/2026, 14:23

260427-rqggzadv7s7

Sharing

Copy URL Twitter E-mail

General

  • Target
    b649944f79f7f0e8a1c550f92190015ce473b8841f8c1.exe
  • Size 186KB
  • Sample260817-ec4dcssgla
  • SHA256 b649944f79f7f0e8a1c550f92190015ce473b8841f8c14137a1e07154bf29774
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
amadeydiscoveryexecutioninstallerpersistencetrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 5.80

C2

  • http://196.251.107.248

Attributes
  • install_dir

    96a2578040

  • install_file

    Yoyotvinm.exe

  • strings_key

    f7a2b3543f3c4ed94d892e4efc544f8a

  • url_paths

    /kont2rt/index.php

rc4.plain

Targets

    • Target
      b649944f79f7f0e8a1c550f92190015ce473b8841f8c1.exe
    • Size 186KB
    • SHA256 b649944f79f7f0e8a1c550f92190015ce473b8841f8c14137a1e07154bf29774
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionamadeyinstallerpersistencetrojanupx

    • Detects Amadey x86-bit Payload

    • Family: Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks