General
-
Target
033bbc64f889777be17fa5bc28439d1ee79c94a611a58853790eb865c7d87d54.zip
-
Size
1.0MB
-
Sample
230321-qqta4acf31
-
MD5
2cc93327da0aed12a86c93f76ff788da
-
SHA1
59f5f388473da19ad7dd2371379e5453e7b281e5
-
SHA256
8a78117a041241bd414bd0baf00fd1ed2710722d30884833711268d162f2281e
-
SHA512
7cf0fd48014d8b44759b0ec96f70b4e6c8b4feec750fade966c7b1a4871f3bbc5b8514710088757f243b9978c7b938751a2beb9c4fd2119b233b85c27c737d6f
-
SSDEEP
24576:y1t/Xch0IXjSwwck9HXkwq1zAXKyeBDWxLh/mqiZ7+rm34AV:yQVXj5wckI1zAOeLh/vrQV
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Targets
-
-
Target
033bbc64f889777be17fa5bc28439d1ee79c94a611a58853790eb865c7d87d54.exe
-
Size
1.4MB
-
MD5
056d809fc0b3e0af97316dbfbba1481e
-
SHA1
9083da544ba4653ca83df9dc04968e0d084f7cfb
-
SHA256
033bbc64f889777be17fa5bc28439d1ee79c94a611a58853790eb865c7d87d54
-
SHA512
a9e1a5aeea7959e819c34a90673b1086b1c61ac2fa3279798b56991885b203530398aba290e8b2e2eb3f6967b337b24e18c25b085e4fdd4236ef663fdcb21545
-
SSDEEP
24576:j3Bdco8g+Jw+uIWdSNmppQIAni/mqjGYqXGkICzZ+apKOiz4GvaG/9jhNpNbWOAD:fxpxIGJppQIAni/mqjGYqXGbuZ+apKO/
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-