amadey | cfb42c0fe3eb311d8fa034cfd5a996234308371ce9d7945cc74424bf432b4028

General

Target
2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar
Size 17.0MB
Sample261016-dbah8awses
SHA256 cfb42c0fe3eb311d8fa034cfd5a996234308371ce9d7945cc74424bf432b4028
MD5 d96894338e89c2b54f6d58650861a71c
SHA1 fcced004459a498ee5d2f0309452b3ac9470ce3e
SHA512 cd62770de0526ff3fa36a1454f90db68f6ee8dc06ea5d408ac209fbdb465abae25d9a0db8477413b03c252a468c49f4712f3afd8ae0c112b9f9fb3e9b8368ac5
SSDEEP 393216:fWEME7c14wpP5/rUyBt4uBtOoDsRaWhzKu3v521eVW/YgR:feE7qd5QyrBBZs0WMEW/YgR
TLSH
T1170723DAA2E512F8D4A78170964A4B89F7B1B45903B45AAF33C11C531F32DD64F2EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

5.80

Botnet

282234

C2

http://196.251.107.104
http://196.251.107.130

Attributes

install_file
jusched.exe
strings_key
2b027217c3165b773ce9c5d19866b021
url_paths
/Psd8eZaW/index.php

/h84jjfAr/index.php

rc4.hex

Targets

- Target
  2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamanthys_satacom_smoke-loader_stealc_vidar
- Size 17.0MB
- SHA256 cfb42c0fe3eb311d8fa034cfd5a996234308371ce9d7945cc74424bf432b4028
- MD5 d96894338e89c2b54f6d58650861a71c
- SHA1 fcced004459a498ee5d2f0309452b3ac9470ce3e
- SHA512 cd62770de0526ff3fa36a1454f90db68f6ee8dc06ea5d408ac209fbdb465abae25d9a0db8477413b03c252a468c49f4712f3afd8ae0c112b9f9fb3e9b8368ac5
- SSDEEP 393216:fWEME7c14wpP5/rUyBt4uBtOoDsRaWhzKu3v521eVW/YgR:feE7qd5QyrBBZs0WMEW/YgR
- TLSH
  T1170723DAA2E512F8D4A78170964A4B89F7B1B45903B45AAF33C11C531F32DD64F2EF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

282234 discovery amadey trojan
- Family: Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Amadey

UPX dump on OEP (original entry point)

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2