General

  • Target

    0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12

  • Size

    1.4MB

  • Sample

    230310-pms1gsfd7s

  • MD5

    97201c944dcd7e82672458514a67a7b5

  • SHA1

    2bccce2f6a090dd37e7510ac1dc5e1be5526c3d2

  • SHA256

    0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12

  • SHA512

    0a7bd0ad596a2024631792d5c50647c9fc7afa19d67e69417a41f611591d97647f96a5776f05a0a380848d0c027d055437ccff2e037641146a56c8008355e53d

  • SSDEEP

    24576:BdnSOXpaWQoCs7Gzxdnhk6d55xedwiNaE9Jvo6jEsAfdyn1f0IEI0ICERltNGnXj:BdnSOXpaWQoCsaz7B55Mf9Jvo6q

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Targets

    • Target

      0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12

    • Size

      1.4MB

    • MD5

      97201c944dcd7e82672458514a67a7b5

    • SHA1

      2bccce2f6a090dd37e7510ac1dc5e1be5526c3d2

    • SHA256

      0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12

    • SHA512

      0a7bd0ad596a2024631792d5c50647c9fc7afa19d67e69417a41f611591d97647f96a5776f05a0a380848d0c027d055437ccff2e037641146a56c8008355e53d

    • SSDEEP

      24576:BdnSOXpaWQoCs7Gzxdnhk6d55xedwiNaE9Jvo6jEsAfdyn1f0IEI0ICERltNGnXj:BdnSOXpaWQoCsaz7B55Mf9Jvo6q

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects PseudoManuscrypt payload

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • PseudoManuscrypt

      PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks