amadey

General

Target

7d124bc23be85d73b1177143f41b5e72.exe
Size

1.4MB
Sample

221209-ll2z8ach23
MD5

7d124bc23be85d73b1177143f41b5e72
SHA1

09633b90a0b993fd4dec6d522a1243433fc3ab10
SHA256

04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2
SHA512

f4d318361bcccd7a3a77cdb243fa27e46abb6831cc315a4d8c4df9c37f30d11d2a0cd8a0ab9c8567f2c584dbcca1a9c336677216b8e31495c20061b287c29ebe
SSDEEP

24576:jEiV++MCUfiiF5CYElcxGvvJq89F85NURwfCULmNQpBAXFVw/5xbpY0Y8vNcup:jEiV++MCxiF0tJ25NK2mapBA1uxYSlcG

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

56.1

Botnet

1760

C2

https://t.me/vmt001

Attributes

profile_id
1760

Extracted

Family

amadey

Version

3.50

C2

85.209.135.109/jg94cVd30f/index.php

Extracted

Family

systembc

C2

89.22.236.225:4193

176.124.205.5:4193

Targets

- Target
  
  7d124bc23be85d73b1177143f41b5e72.exe
- Size
  
  1.4MB
- MD5
  
  7d124bc23be85d73b1177143f41b5e72
- SHA1
  
  09633b90a0b993fd4dec6d522a1243433fc3ab10
- SHA256
  
  04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2
- SHA512
  
  f4d318361bcccd7a3a77cdb243fa27e46abb6831cc315a4d8c4df9c37f30d11d2a0cd8a0ab9c8567f2c584dbcca1a9c336677216b8e31495c20061b287c29ebe
- SSDEEP
  
  24576:jEiV++MCUfiiF5CYElcxGvvJq89F85NURwfCULmNQpBAXFVw/5xbpY0Y8vNcup:jEiV++MCxiF0tJ25NK2mapBA1uxYSlcG
Score

10^/10

amadey systembc vidar 1760 discovery persistence spyware stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2