amadey

General

Target

97201c944dcd7e82672458514a67a7b5.bin
Size

874KB
Sample

230312-b517xsec2x
MD5

efe511a6447236cc9060d75aad4db322
SHA1

eaf538cbdfc4c70ef0c0908e04f3c3ec1a9347b6
SHA256

caff4b32dd7a409701659512068dbf972b1afa11b06533e17b4e52083576f64c
SHA512

22ed255764f3d6b1f83fe110efc5a35736daf385dd1817a2054c4b63adde3a9bdd8c86d9ac594b8dbfcf6f7ed53778d829929476bd5b72cffed8a32850b73292
SSDEEP

24576:B4MjE00TT+xJ7ot0BN8ilwNpwzVTQnTif:WMiT+xZot0UncTQTif

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Targets

- Target
  
  0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12.exe
- Size
  
  1.4MB
- MD5
  
  97201c944dcd7e82672458514a67a7b5
- SHA1
  
  2bccce2f6a090dd37e7510ac1dc5e1be5526c3d2
- SHA256
  
  0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12
- SHA512
  
  0a7bd0ad596a2024631792d5c50647c9fc7afa19d67e69417a41f611591d97647f96a5776f05a0a380848d0c027d055437ccff2e037641146a56c8008355e53d
- SSDEEP
  
  24576:BdnSOXpaWQoCs7Gzxdnhk6d55xedwiNaE9Jvo6jEsAfdyn1f0IEI0ICERltNGnXj:BdnSOXpaWQoCsaz7B55Mf9Jvo6q
Score

10^/10

pseudomanuscrypt loader amadey spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects PseudoManuscrypt payload
  loader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2