amadey

General

Target

0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12.zip
Size

874KB
Sample

230311-ps571ahe69
MD5

7c7daf4a70195a38e93b088d7f132a2d
SHA1

1bc4fc8888b0bf4abea653e2b5dc65db357a7e6f
SHA256

87cb73d3eba22e5dce74ce24e7512577ecb6b0d1d2fca701322d0bf5c83f1a63
SHA512

def892e651c75e66bed0d1319c91167dc77bf00ed215eb9dad0e69fad6a2882b5de1a76408962adcb61b8fa94ca6498ae7c51dae3bd01175b79fbfe345769945
SSDEEP

12288:fLpyCbj5Q7IbJEkkTAxpMfuXdiClbb8JWkEGrccTLsJ2Kl8SdhS16qbTkON7tyJg:f9y0e78JsTAztAJWgr3Ty2MS16qbNaej

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Targets

- Target
  
  0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12.exe
- Size
  
  1.4MB
- MD5
  
  97201c944dcd7e82672458514a67a7b5
- SHA1
  
  2bccce2f6a090dd37e7510ac1dc5e1be5526c3d2
- SHA256
  
  0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12
- SHA512
  
  0a7bd0ad596a2024631792d5c50647c9fc7afa19d67e69417a41f611591d97647f96a5776f05a0a380848d0c027d055437ccff2e037641146a56c8008355e53d
- SSDEEP
  
  24576:BdnSOXpaWQoCs7Gzxdnhk6d55xedwiNaE9Jvo6jEsAfdyn1f0IEI0ICERltNGnXj:BdnSOXpaWQoCsaz7B55Mf9Jvo6q
Score

10^/10

pseudomanuscrypt loader amadey spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects PseudoManuscrypt payload
  loader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2