amadey

Resubmissions

15-12-2022 01:43

221215-b5f7raee31 10

11-11-2022 02:58

221111-dgk7xagea9 10

11-11-2022 00:49

221111-a6lm7affh7 10

Sharing

Copy URL

Twitter E-mail

General

Target

1234.zip
Size

10.0MB
Sample

221111-a6lm7affh7
MD5

b00fb64492bfd306017b2b02334c3249
SHA1

86fcca8368e8fd6e3eb00cdc52ca0230a585ae20
SHA256

7df24cd763886c8b925a54be3e292fc75b6e49047709bbc1910fe50d81abcdb3
SHA512

d9bf9cc219453e1031d4a077c0d65a0c37ba24db4a323980fd6816d0065bef944568656562eb565cf432a0c13f52086f7eea376c908597cece0ffb39837f5477
SSDEEP

196608:S1Tx4O3zPtUJl0EP3vcXJBDxtm4fx+8wIAQmzfAL21/zCGx+dVLyiF:SN4atUJya3vmBDXf/hAQ+B1/z/xUVLX

Malware Config

Extracted

Family

privateloader

208.67.104.60

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes

payload_url
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Extracted

Family

redline

Botnet

6.67

103.89.90.61:34589

Attributes

auth_value
57de334192d09500bf7d628d081a6039

Extracted

Family

redline

37.139.128.203:10925

Attributes

auth_value
d37697fc398092da22f2d13a99bd24cb

Extracted

Family

raccoon

Botnet

d2f643fdb867ca6beffc12549d6afb13

http://167.235.134.14/

rc4.plain

Extracted

Family

redline

Botnet

neruzki

193.106.191.22:47242

Attributes

auth_value
be14ae67c6dd227f622680a27ea42452

Extracted

Family

redline

Botnet

new11102

jalocliche.xyz:81

chardhesha.xyz:81

Attributes

auth_value
38d4d92e028d88b56e58b649e85ec687

Extracted

Family

redline

Botnet

711

194.110.203.100:32796

Attributes

auth_value
24e3340d853c89cad1e25194559ee778

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://fluxportugal.pt/js/vendor/config_40.ps1

Extracted

Family

nymaim

45.139.105.171

85.31.46.167

Extracted

Family

redline

Botnet

PerseCloud Logs

151.80.89.227:45878

Attributes

auth_value
f35e78a6b4be27a5c8621510cdcfa361

Targets

- Target
  
  Install.exe
- Size
  
  7.9MB
- MD5
  
  2cc80b5a83b5e1b96bf817d26099e664
- SHA1
  
  2507f7ca248884372a3088bf6413bd8292f898ca
- SHA256
  
  06c9681d0fcdc083535d3aaa823b0d5a483bb93f237fb7857cd8e72b20f4088c
- SHA512
  
  d5027ecda8337735e2149f6048124975e06e25865150f01b357d80926c8b786e1e0dc64cebf51b7c85bc5f72ec07571a4f170882ed386753ff6905b7dd2ba007
- SSDEEP
  
  196608:Pkc8XmEtyfj6x5kMdFYjdYb9UNaLhKxgNq+W3D:Pkc8WEw4kAFYqUNaLhqgNVA
Score

10^/10

privateloader raccoon redline 6.67 711 d2f643fdb867ca6beffc12549d6afb13 neruzki new11102 infostealer loader spyware stealer amadey nymaim smokeloader persecloud logs backdoor collection discovery evasion main persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Smokeloader packer
- NyMaim
  NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
  trojan nymaim
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  cdp.dll
- Size
  
  4.2MB
- MD5
  
  11d2616c6a773415b39b6ac4aeb71c7a
- SHA1
  
  5f20830c35bf6f1a770cf57c2ab917354b9a4524
- SHA256
  
  bc936b3e8fe3e2f1c5dd7e41f0722945c9e21fd8c9a50328db3692df6e3e84c8
- SHA512
  
  f88692a648e890f8651403b200ac34d24851e31e2243214edbb1254468d78aac675b4c24678b4735be7bd17947ca29016f0e3d00a7a920e070669f6d4a6645ad
- SSDEEP
  
  98304:BMBQToECHHb6tDRTb+q4ozElywdv6nJpJt7+:SqcESHbG+q4ozElYnJr
Score

1^/10
behavioral3 behavioral4
- Target
  
  langs/Hungarian.ini
- Size
  
  107KB
- MD5
  
  7591df7fae4342cbc7a0706e1b28e87b
- SHA1
  
  825e88ad498e8713522f5aef3b21ee01d6fa8b41
- SHA256
  
  fe9997629d296908247a2e82da6c369e2ea7eb4c87b12fc7c8d3ecb3e6fc320d
- SHA512
  
  8f58c6fbaf5ea140a3ecbbc88cbf4bdd0e0ba3fbdf169f4b7cb831094a47a6ead103f89fc07748f91d1396ebd13c7ebcc90a316f0eb203ff4c86a50be5cd3ca4
- SSDEEP
  
  3072:UaKBsDgGod8NAH4iyf8kXrLfKgL6YhL+L3yGU:73X
Score

1^/10
behavioral5 behavioral6
- Target
  
  langs/Korean.ini
- Size
  
  91KB
- MD5
  
  efae0c78be2abe2920c78b9d4785ab45
- SHA1
  
  8c0799fb68852cb071bbe260deb4ab357bd5f4ed
- SHA256
  
  ad556989f6e4a683d9668e41d2d7175b7b46847c2eef26188b9075fc600d0132
- SHA512
  
  44737be4d4bd0f93ca3e986c89102612932f3749b8e9b89446a567cff60ceb856b4bd7380da7fe3f1809579e6ec2162d0cdd4a217935a4961c6b36a482dd4ac8
- SSDEEP
  
  768:wPYhkzQl6qE7rY+xuPAsyKVmq8Ag8lyWqFk5ziCfsg8S+EZNlWJ7lxyBiCWfbMav:HSzQlc7siCmq8AFlBmLfbNA2Nt7osVP
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Scripting

T1064

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detects Smokeloader packer

NyMaim

PrivateLoader

Process spawned unexpected child process

Raccoon

RedLine

RedLine payload

SmokeLoader

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8