amadey

General

Target

6e57786483bbce691fe47bb58a694b604287491f5aef7680b707f13503d7d8d8.bin
Size

269KB
Sample

221116-zg4j5sch26
MD5

da26e014194bc09471cff4f7db14338c
SHA1

18be68122a35c61906730719870d505be3a98e9e
SHA256

6e57786483bbce691fe47bb58a694b604287491f5aef7680b707f13503d7d8d8
SHA512

1a793d1ba4d01b0ac33229b2321c556d933097d44258de27c90ce0f6999d57acd34b885572a279d4d6d8b70732e21e773aa5854421d54adba28611b4e070c63d
SSDEEP

3072:WXKp+4Ozq562I4CUAeJHk5UCrh5v2cNSI/ZZCKcs+MfCjM8vxshYM/h3qpZa9uDQ:+a+VoIX8k5x2cPZxV/CyhYrwVfX

Malware Config

Extracted

Family

redline

Botnet

3m

C2

jalocliche.xyz:81

chardhesha.xyz:81

Attributes

auth_value
e7297ca71163c923562e84cf53f5dc0e

Extracted

Family

vidar

Version

55.7

Botnet

1827

C2

https://t.me/deadftx

https://www.ultimate-guitar.com/u/smbfupkuhrgc1

Attributes

profile_id
1827

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Extracted

Family

raccoon

Botnet

d8f44b07b06da3a90ad87ebc9249718c

C2

http://79.137.205.87/

rc4.plain

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Client6

C2

46.3.199.101:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Windows Security Shell.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  6e57786483bbce691fe47bb58a694b604287491f5aef7680b707f13503d7d8d8.bin
- Size
  
  269KB
- MD5
  
  da26e014194bc09471cff4f7db14338c
- SHA1
  
  18be68122a35c61906730719870d505be3a98e9e
- SHA256
  
  6e57786483bbce691fe47bb58a694b604287491f5aef7680b707f13503d7d8d8
- SHA512
  
  1a793d1ba4d01b0ac33229b2321c556d933097d44258de27c90ce0f6999d57acd34b885572a279d4d6d8b70732e21e773aa5854421d54adba28611b4e070c63d
- SSDEEP
  
  3072:WXKp+4Ozq562I4CUAeJHk5UCrh5v2cNSI/ZZCKcs+MfCjM8vxshYM/h3qpZa9uDQ:+a+VoIX8k5x2cPZxV/CyhYrwVfX
Score

10^/10

smokeloader backdoor trojan amadey asyncrat eternity raccoon redline vidar 1827 3m client6 d8f44b07b06da3a90ad87ebc9249718c collection infostealer persistence rat spyware stealer upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Async RAT payload
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2