amadey

General

Target

4773ad3737fb318ec3750c33f15b48b0b0361f605ec1c725fcc9d2cc9280d961
Size

348KB
Sample

221202-sgtllsdb3s
MD5

8a6f27e36cd5ae5bf5e3ba51ac3c55d0
SHA1

fc9e1ec1a40487d0881db4d8ee1f3c10b0163f3a
SHA256

4773ad3737fb318ec3750c33f15b48b0b0361f605ec1c725fcc9d2cc9280d961
SHA512

339057801513711ef27f6de26148e555669dbdd3fbf7ece471a6626433649768388bba9a18c102c8329c9cbd2f185d293be492f87aeabb8054e93aec67d7cf5d
SSDEEP

6144:l7nIhLGASAYpPBD2wRNO8UpsR+xZLlw5quRjMgU:lz2EAY3VUNmaZ0RQg

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1148

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1148

Extracted

Family

amadey

Version

3.50

C2

62.204.41.252/nB8cWack3/index.php

Extracted

Family

xworm

C2

max.con-ip.com:4449

Mutex

vjIA8LKaxkoYpSCl

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

vidar

Version

56

Botnet

1881

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1881

Targets

- Target
  
  4773ad3737fb318ec3750c33f15b48b0b0361f605ec1c725fcc9d2cc9280d961
- Size
  
  348KB
- MD5
  
  8a6f27e36cd5ae5bf5e3ba51ac3c55d0
- SHA1
  
  fc9e1ec1a40487d0881db4d8ee1f3c10b0163f3a
- SHA256
  
  4773ad3737fb318ec3750c33f15b48b0b0361f605ec1c725fcc9d2cc9280d961
- SHA512
  
  339057801513711ef27f6de26148e555669dbdd3fbf7ece471a6626433649768388bba9a18c102c8329c9cbd2f185d293be492f87aeabb8054e93aec67d7cf5d
- SSDEEP
  
  6144:l7nIhLGASAYpPBD2wRNO8UpsR+xZLlw5quRjMgU:lz2EAY3VUNmaZ0RQg
Score

10^/10

amadey smokeloader vidar xworm 1148 1881 backdoor collection discovery persistence rat spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1