amadey

General

Target

bf3ba6986c24b775418721fdbbe75f5c.bin
Size

7.7MB
Sample

230130-x9pkkscc83
MD5

b8caf456dd87764f3ec099ad95634378
SHA1

796cf0e18dd129eab19055340a7182cdb7b62197
SHA256

9671026453b91d4fbde7be21bf9c469897673c240a5f1777deca79ce4a5aa451
SHA512

a8cb83ec1e4107f7bb786098b60a6d2616e3c1aac55e93bf4aefaa2859d34235f3447a7564ddcf3c0ef8bc110d7379035f572f39282d923df04d8bd2f0464064
SSDEEP

196608:0yCto8GtlCKw4ZAGsXD7MPCHpfOy6wiMdiACsR3:0XlGtlCKu8PCFpRx

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

raccoon

Botnet

04f8fa0bf52b1b98a127f6deeac54f84

C2

http://94.131.3.70/

http://83.217.11.11/

http://83.217.11.13/

http://83.217.11.14/

http://45.15.156.222/

rc4.plain

Extracted

Family

vidar

Version

2.3

Botnet

736

C2

https://t.me/mantarlars

https://steamcommunity.com/profiles/76561199474840123

Attributes

profile_id
736

Targets

- Target
  
  2e09674fc46e09a14bcfc5e3078de72c91c17d6fd3aac5146677cbe94a784d24.exe
- Size
  
  8.0MB
- MD5
  
  bf3ba6986c24b775418721fdbbe75f5c
- SHA1
  
  a46212c6d3d8329135b4780786b5581c6c2bb5b4
- SHA256
  
  2e09674fc46e09a14bcfc5e3078de72c91c17d6fd3aac5146677cbe94a784d24
- SHA512
  
  cc16a928eb457bccd1a70cb7fd075364f1fa120bbf0ea347f9b4310fda7828807502355d8d209d8fd4c3d664af16732226eacf553d4980f5ee59c8f3409693f5
- SSDEEP
  
  196608:5pDVnj97FG29WPpw4xOQiuIQz1wckK2m:5pJnZh4G4xOhuIQzpZ2
Score

10^/10

amadey xmrig evasion miner spyware stealer trojan upx vmprotect raccoon smokeloader vidar 04f8fa0bf52b1b98a127f6deeac54f84 736 backdoor discovery
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Smokeloader packer
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Stops running service(s)
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2