amadey

Sharing

Copy URL

Twitter E-mail

General

Target

68182b16334c8170c73c571fa10f147a.exe
Size

186KB
Sample

211028-scqddsbgd4
MD5

68182b16334c8170c73c571fa10f147a
SHA1

de83396eab9ee9eff7c445b5778b402051d78725
SHA256

aac7861a3beff9b0f769ecbf617ee8e4c44ff1bf077bbe266fc4fcfe5bf92703
SHA512

9492b95a8d36303a6758ec9c88cfff04c9d2ae8b905b928be60c3689aa5ef1eedcc7314c513ca4854a78dc73e1381aaf735ad3bc136581d02977487037e17aa1

Malware Config

Extracted

Family

smokeloader

Version

2020

http://xacokuo8.top/

http://hajezey1.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

http://planilhasvba.com.br/wp-admin/js/k/index.php

http://rpk32ubon.ac.th/backup/k/index.php

http://4urhappiness.com/app/k/index.php

http://swedenkhabar.com/wp-admin/js/k/index.php

http://cio.lankapanel.net/wp-admin/js/k/index.php

http://fcmsites.com.br/canal/wp-admin/js/k/index.php

http://lacoibipitanga.com.br/maxart/k/index.php

http://lacoibipitanga.com.br/cgi-bin/k/index.php

http://video.nalahotel.com/k/index.php

http://diving-phocea.com/wp-admin/k/index.php

rc4.i32

Extracted

Family

redline

Botnet

999323

93.115.20.139:28978

Extracted

Family

vidar

Version

41.6

Botnet

754

https://mas.to/@lilocc

Attributes

profile_id
754

Extracted

Family

redline

Botnet

SafeInstaller

185.183.32.161:80

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

Super star

185.183.32.183:55694

Extracted

Family

redline

Botnet

dywa

45.67.231.145:10991

Extracted

Family

amadey

Version

2.70

185.215.113.45/g4MbvE/index.php

Extracted

Family

redline

Botnet

@soul3ss

95.216.43.58:40566

Targets

- Target
  
  68182b16334c8170c73c571fa10f147a.exe
- Size
  
  186KB
- MD5
  
  68182b16334c8170c73c571fa10f147a
- SHA1
  
  de83396eab9ee9eff7c445b5778b402051d78725
- SHA256
  
  aac7861a3beff9b0f769ecbf617ee8e4c44ff1bf077bbe266fc4fcfe5bf92703
- SHA512
  
  9492b95a8d36303a6758ec9c88cfff04c9d2ae8b905b928be60c3689aa5ef1eedcc7314c513ca4854a78dc73e1381aaf735ad3bc136581d02977487037e17aa1
Score

10^/10

raccoon redline smokeloader vidar 60e59be328fbd2ebac1839ea99411dccb00a6f49 754 999323 dywa safeinstaller super star backdoor discovery infostealer spyware stealer trojan amadey @soul3ss evasion persistence
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Turns off Windows Defender SpyNet reporting
  evasion
- UAC bypass
  evasion trojan
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- Nirsoft
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Bypass User Account Control

T1088

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Raccoon

RedLine

RedLine Payload

SmokeLoader

Turns off Windows Defender SpyNet reporting

UAC bypass

Vidar

Windows security bypass

Nirsoft

Vidar Stealer

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2