amadey

General

Target

3cee28ef52c59c99b841c6927f5085e483523cb8b606ff9ce5d60b3c13574545.zip
Size

2.5MB
Sample

221114-lqhgdabf3z
MD5

fda57adb6f6e97af8210a2a540dd91dc
SHA1

72155f16064107ed389cb2c0f85f7d68a3fb3c38
SHA256

877760823121870d7ec5f03909cd4430f6856e60256678d6a1ac790f6f7fde6e
SHA512

773981f1221412fbdcd39712c1b515e608ed53377ec6dd30815b073379bea155fe3c3067d04217738cfdf642b68781a3f4e5c107b1a480e84c3eb2bf1b6d31d9
SSDEEP

49152:CLv5/emHxI9V387AgkH3YJtpp28d2MWuKil:Cd2MkMcgkXE728iHc

Malware Config

Extracted

Family

nullmixer

C2

http://sokiran.xyz/

Extracted

Family

vidar

Version

39.7

Botnet

933

C2

https://shpak125.tumblr.com/

Attributes

profile_id
933

Extracted

Family

vidar

Version

55.6

Botnet

1679

C2

https://t.me/seclab_new

https://raw.githubusercontent.com/sebekeloytfu/simple-bash-scripts/master/calculator.sh

Attributes

profile_id
1679

Extracted

Family

vidar

Version

55.6

Botnet

937

C2

https://t.me/seclab_new

https://raw.githubusercontent.com/sebekeloytfu/simple-bash-scripts/master/calculator.sh

Attributes

profile_id
937

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

- Target
  
  3cee28ef52c59c99b841c6927f5085e483523cb8b606ff9ce5d60b3c13574545.exe
- Size
  
  2.6MB
- MD5
  
  5f602e4e99943fb97e71990ce6eaab90
- SHA1
  
  aa7fd6f5ea73074ae64a989469fcc14a6ac3e2f3
- SHA256
  
  3cee28ef52c59c99b841c6927f5085e483523cb8b606ff9ce5d60b3c13574545
- SHA512
  
  db30274ca70ad39daf7643bf6d21ff338bdb0b39510f09e215d8440a534e47bb32460587a92c76fd8f3549a850dea43aa77b8dedb48481f221de05e451d95312
- SSDEEP
  
  49152:xcBIPkZVi7iKiF8cUvFyP2jckAjxt3htaPkvAesMMOZEwJ84vLRaBtIl9mTzKJJ:xuri7ixZUvFyPScjVt4j/hCvLUBsK+n
Score

10^/10

amadey nullmixer privateloader smokeloader tofsee vidar 1679 933 937 aspackv2 backdoor discovery dropper evasion loader persistence spyware stealer themida trojan vmprotect
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Smokeloader packer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2