Overview

overview

10

Static

static

10

8b5d014d50...a5.exe

windows10-2004-x64

10

8b5d014d50...a5.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5.bin
  • Size 321KB
  • Sample261107-vs55wsev5j
  • SHA256 8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
amadey59b440discoveryexecutionpersistencetrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 3.87

Botnet

  • 59b440

C2

  • http://77.91.68.18

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

  • url_paths

    /nice/index.php

rc4.plain

Targets

    • Target
      8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5.bin
    • Size 321KB
    • SHA256 8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    59b440discoveryexecutionamadeypersistencetrojan

    • Detects Amadey x86-bit Payload

    • Family: Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks