General
-
Target
b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
-
Size
334KB
-
Sample
211024-d4sv9sdhek
-
MD5
661a32c0d713d6ee0d478904c088b2d3
-
SHA1
24875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
-
SHA256
b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
-
SHA512
a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
amadey
2.70
185.215.113.45/g4MbvE/index.php
Targets
-
-
Target
b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
-
Size
334KB
-
MD5
661a32c0d713d6ee0d478904c088b2d3
-
SHA1
24875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
-
SHA256
b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
-
SHA512
a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-