amadey

Resubmissions

11-08-2022 21:06

220811-zx3msacdem 10

17-05-2022 15:11

220517-sk226adgh4 10

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.zip
Size

224KB
Sample

220517-sk226adgh4
MD5

568adf1dff00d48fb4742bd0bfb7c113
SHA1

1793aa4a491a34fa71e032b23cb1c6e31dcbfc32
SHA256

99d3f10c4d55500225e8b87d6aa9490baef6c5e22be004d6048979f0ed687c29
SHA512

30e3b2b453af37b46186ddf75c2dc7889f8a96125b527816a582f1ef008147b755250416b33f3d8073df48c6bc560caf7f68d4b28d137b7fc7d2661f018adb91

Malware Config

Extracted

Family

redline

Botnet

Build#10k

89.22.234.161:36760

Attributes

auth_value
c22a130ec5d494a6a043d8ef902913cb

Extracted

Family

redline

Botnet

SUSHI

65.108.101.231:14648

Attributes

auth_value
26bcdf6ae8358a98f24ebd4bd8ec3714

Extracted

Family

amadey

Version

3.10

185.215.113.38/f8dfksdj3/index.php

Extracted

Family

vidar

Version

52.2

Botnet

1383

https://t.me/netflixaccsfree

https://mastodon.social/@ronxik12

Attributes

profile_id
1383

Extracted

Family

djvu

http://ugll.org/test3/get.php

Attributes

extension
.fefg
offline_id
eBNgvyGQV1Hmt9DBdxVRs8qPi1agsS7OaohPmit1
payload_url
http://zerit.top/dl/build2.exe

http://ugll.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-j3AdKrnQie Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0482JIjdm

rsa_pubkey.plain

Extracted

Family

redline

Botnet

@humus228p

185.215.113.24:15994

Attributes

auth_value
bb99a32fdff98741feb69d524760afae

Extracted

Family

smokeloader

Version

2020

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

rc4.i32

Extracted

Family

vidar

Version

52.2

Botnet

937

https://t.me/netflixaccsfree

https://mastodon.social/@ronxik12

Attributes

profile_id
937

Targets

- Target
  
  Setup.zip
- Size
  
  224KB
- MD5
  
  568adf1dff00d48fb4742bd0bfb7c113
- SHA1
  
  1793aa4a491a34fa71e032b23cb1c6e31dcbfc32
- SHA256
  
  99d3f10c4d55500225e8b87d6aa9490baef6c5e22be004d6048979f0ed687c29
- SHA512
  
  30e3b2b453af37b46186ddf75c2dc7889f8a96125b527816a582f1ef008147b755250416b33f3d8073df48c6bc560caf7f68d4b28d137b7fc7d2661f018adb91
Score

1^/10
behavioral1 behavioral2
- Target
  
  Setup.exe
- Size
  
  382KB
- MD5
  
  38b5deb16f9cd877a6a7ca7c7434b5ea
- SHA1
  
  11051c4a389238fe7e2202cb506a6f23cfa6bfa4
- SHA256
  
  5b92d1d8c1df0cc42591bc05cb62331a28f54e3566c708a8fd13b00cb76881c2
- SHA512
  
  f1f75b2f2641e09c1ce71b7d442b30169b6335d2e15a6fc9bfcb94ffa6552d4f8783cd6468016789d249e2633332e705631e06ad9ede80c03f87e4a051aee899
Score

10^/10

evasion spyware stealer suricata trojan amadey djvu redline smokeloader vidar 1383 937 @humus228p build#10k sushi backdoor discovery infostealer persistence ransomware upx vmprotect
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Amadey CnC Check-In
  suricata: ET MALWARE Amadey CnC Check-In
  suricata
- suricata: ET MALWARE Possible Windows executable sent when remote host claims to send html content
  suricata: ET MALWARE Possible Windows executable sent when remote host claims to send html content
  suricata
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata
- suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
  suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
  suricata
- suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
  suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
  suricata
- suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
  suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
  suricata
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata
- suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata
- suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
  suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detected Djvu ransomware

Djvu Ransomware

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

RedLine

RedLine Payload

SmokeLoader

Vidar

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Possible Windows executable sent when remote host claims to send html content

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download

suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload

Vidar Stealer

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

UPX packed file

VMProtect packed file

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Reads user/profile data of web browsers

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4