amadey

General

Target

f73d823313bd7218e8a3a00916ccbe3137e19ed4679a43a452663dcce1c799d9
Size

6.2MB
Sample

221210-jq88zshh41
MD5

9e59e36488bfcebe5acba259c6ba6195
SHA1

65ba9bfa1e66bf09b0d3064746c15246b9fcc049
SHA256

f73d823313bd7218e8a3a00916ccbe3137e19ed4679a43a452663dcce1c799d9
SHA512

f043684854247db8ead2823105942009ca8b8bb3d1d58b80d1ee851fb028afa7374bc29661c46f4e9ca6d5896dacd56a3c297161c3c71f5b4db2dbfd9f797ecd
SSDEEP

98304:FjWC/PP6KALpuDlnRoTsUzBPPPPTycfOsjaTA5Tny6dDFFMcubn36fBu:FyC/lALkD7oTJP+cfDaM57y6PNuO5u

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

85.209.135.109/jg94cVd30f/index.php

Extracted

Family

systembc

C2

89.22.236.225:4193

176.124.205.5:4193

Extracted

Family

gozi

Targets

- Target
  
  f73d823313bd7218e8a3a00916ccbe3137e19ed4679a43a452663dcce1c799d9
- Size
  
  6.2MB
- MD5
  
  9e59e36488bfcebe5acba259c6ba6195
- SHA1
  
  65ba9bfa1e66bf09b0d3064746c15246b9fcc049
- SHA256
  
  f73d823313bd7218e8a3a00916ccbe3137e19ed4679a43a452663dcce1c799d9
- SHA512
  
  f043684854247db8ead2823105942009ca8b8bb3d1d58b80d1ee851fb028afa7374bc29661c46f4e9ca6d5896dacd56a3c297161c3c71f5b4db2dbfd9f797ecd
- SSDEEP
  
  98304:FjWC/PP6KALpuDlnRoTsUzBPPPPTycfOsjaTA5Tny6dDFFMcubn36fBu:FyC/lALkD7oTJP+cfDaM57y6PNuO5u
Score

10^/10

amadey gozi systembc banker collection evasion isfb persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Modifies security service
  evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Stops running service(s)
  evasion
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1