amadey | 3082788b6d3e6720e495b738aa3d71744a4d55ab35fbb1c8d33146fd258e19ed

General

Target
2026-08-23_07e9c654d5bbdfd8e2c315086c799611_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Size 260KB
Sample260824-we7x1aed53
SHA256 3082788b6d3e6720e495b738aa3d71744a4d55ab35fbb1c8d33146fd258e19ed
MD5 07e9c654d5bbdfd8e2c315086c799611
SHA1 b12e5ebc4f817d24fc3c1032611400996d822e53
SHA512 9d2ae1041bc68f588184b08133aecb2fd422298e7ff5e5ac5876f44f5aeacf8b5ef4633a8dc3c4ea80b75e22fbeb5bbc1b8bd2069966251f7562b1b51e166601
SSDEEP 6144:F/D1GHgyYjyNnqxJWM0tQ6y7V0nmtCuCcP2VTE33:FyYjyVqxJWM6e7OnmtCuCcP2Va
TLSH
T1894419617926C031D55061762DA8BFF6C19DAC25ABB085DB77800F7AC6212E77A30F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

2cc7a9 discovery execution amadey persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.21

Botnet

2cc7a9

C2

http://185.215.113.204

Attributes

install_dir
580e612ff0
install_file
bguuwe.exe
strings_key
11ae05ddf878fd8a904552f1e0be6ecb
url_paths
/Lkb2dxj3/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c504-4.dat	family_amadey_v2

Executes dropped EXE 4 IoCs

pid	Process
5032	bguuwe.exe
5528	bguuwe.exe
1824	bguuwe.exe
2768	bguuwe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_07e9c654d5bbdfd8e2c315086c799611_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bguuwe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2572	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 5032	2960	2026-08-23_07e9c654d5bbdfd8e2c315086c799611_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	89
PID 5032 wrote to memory of 5444	5032	bguuwe.exe	90
PID 5032 wrote to memory of 2572	5032	bguuwe.exe	92
PID 5444 wrote to memory of 1840	5444	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-23_07e9c654d5bbdfd8e2c315086c799611_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_07e9c654d5bbdfd8e2c315086c799611_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe
  "C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\580e612ff0\
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\580e612ff0\
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bguuwe.exe /TR "C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2572

C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe
C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe
1⤵
- Executes dropped EXE
PID:5528

C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe
"C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe"
1⤵
- Executes dropped EXE
PID:1824

C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe
"C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe"
1⤵
- Executes dropped EXE
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bguuwe.exe

Path C:\Users\Admin\AppData\Local\Temp\580e612ff0\bguuwe.exe
Size 260KB
SHA256 3082788b6d3e6720e495b738aa3d71744a4d55ab35fbb1c8d33146fd258e19ed
MD5 07e9c654d5bbdfd8e2c315086c799611
SHA1 b12e5ebc4f817d24fc3c1032611400996d822e53
SHA512 9d2ae1041bc68f588184b08133aecb2fd422298e7ff5e5ac5876f44f5aeacf8b5ef4633a8dc3c4ea80b75e22fbeb5bbc1b8bd2069966251f7562b1b51e166601
SSDEEP 6144:F/D1GHgyYjyNnqxJWM0tQ6y7V0nmtCuCcP2VTE33:FyYjyVqxJWM6e7OnmtCuCcP2Va
TLSH
T1894419617926C031D55061762DA8BFF6C19DAC25ABB085DB77800F7AC6212E77A30F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

936545689704

Path C:\Users\Admin\AppData\Local\Temp\936545689704
Size 131KB
SHA256 8911dd038cfb600cb9445a663cb4a03b19d37df01c65c1b92cb0d185e0edd0ab
MD5 7b66dcaa76720791d9ae48f10158a826
SHA1 a496a389c64c3fd9bd03603b5873ba01a9a633ab
SHA512 500be3e1e766322554790c7173542cdc7e655400fb66d464bc7242462a55fbd9949fe17beeb149db5f6ccf2866fad23d76585f1eb64035eb3df17019d56ed7ab
SSDEEP 3072:/1mYdu9S+4ci4k8safgpXFKvpGaf3tUXnMW9Ux3:E2cih8sigpaZf3tUXLOx3
TLSH
T12ED3E8139C048B87E16C97E8FD074EAD1F5A6B18E4933AFB05621ECB3E605661D8E13D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads