amadey

General

Target

7D9E22E88F7B5ABF22553DFC438D8F40E17C33E8FC9FB.exe
Size

230KB
Sample

220518-k6ql9aaghj
MD5

20412e905d572b58bb5e8cc8b30ad9c3
SHA1

0a52d28426e056c1369a5432f1c7ab5a752d2525
SHA256

7d9e22e88f7b5abf22553dfc438d8f40e17c33e8fc9fb0141f25eaaba8ebca6e
SHA512

830dccea4a0bfce71ef22d74e5a53f7e131fd662b3f2f884b9d144d7e6e3f9fcf71f7c4a373954cb541d1d2f54805752cb6b9cabe98db9ad585392475b4dc191

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

SUSHI

C2

65.108.101.231:14648

Attributes

auth_value
26bcdf6ae8358a98f24ebd4bd8ec3714

Extracted

Family

amadey

Version

3.10

C2

185.215.113.38/f8dfksdj3/index.php

Extracted

Family

redline

Botnet

@humus228p

C2

185.215.113.24:15994

Attributes

auth_value
bb99a32fdff98741feb69d524760afae

Extracted

Family

vidar

Version

52.2

Botnet

937

C2

https://t.me/netflixaccsfree

https://mastodon.social/@ronxik12

Attributes

profile_id
937

Extracted

Family

djvu

C2

http://ugll.org/test3/get.php

Attributes

extension
.fefg
offline_id
eBNgvyGQV1Hmt9DBdxVRs8qPi1agsS7OaohPmit1
payload_url
http://zerit.top/dl/build2.exe

http://ugll.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-j3AdKrnQie Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0482JIjdm

rsa_pubkey.plain

Targets

- Target
  
  7D9E22E88F7B5ABF22553DFC438D8F40E17C33E8FC9FB.exe
- Size
  
  230KB
- MD5
  
  20412e905d572b58bb5e8cc8b30ad9c3
- SHA1
  
  0a52d28426e056c1369a5432f1c7ab5a752d2525
- SHA256
  
  7d9e22e88f7b5abf22553dfc438d8f40e17c33e8fc9fb0141f25eaaba8ebca6e
- SHA512
  
  830dccea4a0bfce71ef22d74e5a53f7e131fd662b3f2f884b9d144d7e6e3f9fcf71f7c4a373954cb541d1d2f54805752cb6b9cabe98db9ad585392475b4dc191
Score

10^/10

amadey djvu redline vidar 937 @humus228p sushi discovery evasion infostealer ransomware spyware stealer suricata trojan upx vmprotect
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Amadey CnC Check-In
  suricata: ET MALWARE Amadey CnC Check-In
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata
- suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2