amadey | cfb42c0fe3eb311d8fa034cfd5a996234308371ce9d7945cc74424bf432b4028

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamant.exe
Size 17.0MB
Sample261016-dbah8awses
SHA256 cfb42c0fe3eb311d8fa034cfd5a996234308371ce9d7945cc74424bf432b4028
MD5 d96894338e89c2b54f6d58650861a71c
SHA1 fcced004459a498ee5d2f0309452b3ac9470ce3e
SHA512 cd62770de0526ff3fa36a1454f90db68f6ee8dc06ea5d408ac209fbdb465abae25d9a0db8477413b03c252a468c49f4712f3afd8ae0c112b9f9fb3e9b8368ac5
SSDEEP 393216:fWEME7c14wpP5/rUyBt4uBtOoDsRaWhzKu3v521eVW/YgR:feE7qd5QyrBBZs0WMEW/YgR
TLSH
T1170723DAA2E512F8D4A78170964A4B89F7B1B45903B45AAF33C11C531F32DD64F2EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

282234 discovery amadey trojan

Malware Config

Extracted

Family

amadey

Version

5.80

Botnet

282234

http://196.251.107.104
http://196.251.107.130

Attributes

install_file
jusched.exe
strings_key
2b027217c3165b773ce9c5d19866b021
url_paths
/Psd8eZaW/index.php

/h84jjfAr/index.php

rc4.hex

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a5-1.dat	UPX

Executes dropped EXE 4 IoCs

pid	Process
1680	jusched.exe
1232	jusched.exe
5704	jusched.exe
3344	jusched.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\jusched.job	2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamant.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jusched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jusched.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamant.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1680	2004	2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamant.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamant.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_d96894338e89c2b54f6d58650861a71c_amadey_cobalt-strike_icedid_luca-stealer_njrat_rhadamant.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
  "C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:1680

C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
"C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe"
1⤵
- Executes dropped EXE
PID:1232

C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
"C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe"
1⤵
- Executes dropped EXE
PID:5704

C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
"C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe"
1⤵
- Executes dropped EXE
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jusched.exe

Path C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
Size 17.0MB
SHA256 cfb42c0fe3eb311d8fa034cfd5a996234308371ce9d7945cc74424bf432b4028
MD5 d96894338e89c2b54f6d58650861a71c
SHA1 fcced004459a498ee5d2f0309452b3ac9470ce3e
SHA512 cd62770de0526ff3fa36a1454f90db68f6ee8dc06ea5d408ac209fbdb465abae25d9a0db8477413b03c252a468c49f4712f3afd8ae0c112b9f9fb3e9b8368ac5
SSDEEP 393216:fWEME7c14wpP5/rUyBt4uBtOoDsRaWhzKu3v521eVW/YgR:feE7qd5QyrBBZs0WMEW/YgR
TLSH
T1170723DAA2E512F8D4A78170964A4B89F7B1B45903B45AAF33C11C531F32DD64F2EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download