amadey

General

Target

54700291b9ffdbe57c9572847080853890c8d668e94f8da6a8f425f5400eceba
Size

197KB
Sample

230311-khwtcsah2t
MD5

4c3aa19b43e3c2d2c152c20e0687de66
SHA1

2884d559a60adece9ae83f4cfa3bf53a4533d0c3
SHA256

54700291b9ffdbe57c9572847080853890c8d668e94f8da6a8f425f5400eceba
SHA512

1e00b48612240dd83e6f163548db2528772731bd393846b304d4d32aa707a1494d0ddf8cbfc399d075e53829eba021618722a539a6936865e3cba2ffd47262a1
SSDEEP

3072:QqfFYBr2vNE8RSEtVEZjgch01Zw25Bl/n0mcglD1yDH:RFKr2vNpSWqtKwilvHzw

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/test2/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.coaq
offline_id
fTU4hYOJ0niv7WAg9utRTzxXv2TcoEvGPJhzIot1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-hhA4nKfJBj Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0659JOsie

rsa_pubkey.plain

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  54700291b9ffdbe57c9572847080853890c8d668e94f8da6a8f425f5400eceba
- Size
  
  197KB
- MD5
  
  4c3aa19b43e3c2d2c152c20e0687de66
- SHA1
  
  2884d559a60adece9ae83f4cfa3bf53a4533d0c3
- SHA256
  
  54700291b9ffdbe57c9572847080853890c8d668e94f8da6a8f425f5400eceba
- SHA512
  
  1e00b48612240dd83e6f163548db2528772731bd393846b304d4d32aa707a1494d0ddf8cbfc399d075e53829eba021618722a539a6936865e3cba2ffd47262a1
- SSDEEP
  
  3072:QqfFYBr2vNE8RSEtVEZjgch01Zw25Bl/n0mcglD1yDH:RFKr2vNpSWqtKwilvHzw
Score

10^/10

amadey djvu smokeloader vidar pub1 sprg backdoor discovery ransomware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1