amadey

General

Target

ab597e47830049e2c4ff24a3b9c806d067bbd42250949d13a4255151858ae796
Size

1.9MB
Sample

230211-bxqq8aag23
MD5

1f8ceaa3bc0f78c30512ffbb02065808
SHA1

daf5c558e8e44e5b16056f18c1b005a628a22efc
SHA256

ab597e47830049e2c4ff24a3b9c806d067bbd42250949d13a4255151858ae796
SHA512

839a900f1c1bd9892d5207e38275daf7685d9980d5d330d6e8acfec9fd8611b1c66d9197b63185861d888b9714d53d596ee359242a1be60814881db8e5491185
SSDEEP

49152:YeN1ldB/30XIRMJsj6/Bt5gWHTdrd1pm2LubfQFlZgLi+4tP:n1ldB/2xCAHHJrd1pCMlZgLv4

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

raccoon

Botnet

04f8fa0bf52b1b98a127f6deeac54f84

C2

http://94.131.3.70/

http://83.217.11.11/

http://83.217.11.13/

http://83.217.11.14/

http://45.15.156.222/

rc4.plain

Targets

- Target
  
  ab597e47830049e2c4ff24a3b9c806d067bbd42250949d13a4255151858ae796
- Size
  
  1.9MB
- MD5
  
  1f8ceaa3bc0f78c30512ffbb02065808
- SHA1
  
  daf5c558e8e44e5b16056f18c1b005a628a22efc
- SHA256
  
  ab597e47830049e2c4ff24a3b9c806d067bbd42250949d13a4255151858ae796
- SHA512
  
  839a900f1c1bd9892d5207e38275daf7685d9980d5d330d6e8acfec9fd8611b1c66d9197b63185861d888b9714d53d596ee359242a1be60814881db8e5491185
- SSDEEP
  
  49152:YeN1ldB/30XIRMJsj6/Bt5gWHTdrd1pm2LubfQFlZgLi+4tP:n1ldB/2xCAHHJrd1pCMlZgLv4
Score

10^/10

amadey spyware stealer trojan vmprotect raccoon 04f8fa0bf52b1b98a127f6deeac54f84 evasion
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2