amadey

General

Target

900fa1e6b63833378bd0f1c8931fd31365f3c23b8b6f1f41270f0e9116d82b0e
Size

4.6MB
Sample

230220-wyzezabh55
MD5

86a4a8c219dfaa2fa36681bf68ff3643
SHA1

763d679de1ec1704783dbb204490564ab0e9f44b
SHA256

900fa1e6b63833378bd0f1c8931fd31365f3c23b8b6f1f41270f0e9116d82b0e
SHA512

aa3e5ad592f7daea0b91768214194d680e96a9c87b56668fcd1acb61578540358ccefd01251d71a7decd42501c4db37286ef9af41c2cc68f2131ca7e68bc0c63
SSDEEP

98304:JAmlGtGtfthAYZG7dhCsAc1qFT9N9I/8lDYqY3mlGHXv5U2WkpVtpUBe2P:JAmaQfthG1ARFpPIklMWlGXGBe2P

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Targets

- Target
  
  900fa1e6b63833378bd0f1c8931fd31365f3c23b8b6f1f41270f0e9116d82b0e
- Size
  
  4.6MB
- MD5
  
  86a4a8c219dfaa2fa36681bf68ff3643
- SHA1
  
  763d679de1ec1704783dbb204490564ab0e9f44b
- SHA256
  
  900fa1e6b63833378bd0f1c8931fd31365f3c23b8b6f1f41270f0e9116d82b0e
- SHA512
  
  aa3e5ad592f7daea0b91768214194d680e96a9c87b56668fcd1acb61578540358ccefd01251d71a7decd42501c4db37286ef9af41c2cc68f2131ca7e68bc0c63
- SSDEEP
  
  98304:JAmlGtGtfthAYZG7dhCsAc1qFT9N9I/8lDYqY3mlGHXv5U2WkpVtpUBe2P:JAmaQfthG1ARFpPIklMWlGXGBe2P
Score

10^/10

amadey pseudomanuscrypt xmrig evasion loader miner spyware stealer trojan upx vmprotect
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects PseudoManuscrypt payload
  loader
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1