General
-
Target
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.zip
-
Size
1.0MB
-
Sample
230321-qqvh6acf4x
-
MD5
a5ca9c2e2bcd942953358f4636e59d59
-
SHA1
126ef90ff10c2033f314e6d9b9f1e1fa4e2c9698
-
SHA256
1664f9d1d170fa67a39deaefd5f7b88b0563e698bab77977ca34019cff306241
-
SHA512
9d6a649b62ac1d08e1c23a5a6f9a00c7fa4081918d77b2aa9f45a5161a99db9f506b050a3f6d7e23c1c26def2bb516b6db68f70474d38a65a9ffb66f993fae45
-
SSDEEP
24576:gIsqW0yrvCFEz9I8jO3OUHUE3hySPP/FDykoVYJB6:gIXW8FA83OUHUqhdPP/FDJbJB6
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Targets
-
-
Target
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe
-
Size
1.4MB
-
MD5
0de84a66b983d2f407390473dd1e37de
-
SHA1
21de93ab0f4e6706403e0bd3167be9aa8178018b
-
SHA256
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969
-
SHA512
37fc3f31dbb2721565c56974638e483cf3700779b4bbe324c26dbf4f45721211516b041b519b63bd8feb653b8b1de6bda8c52736085f72ff597d5fcb8d839a94
-
SSDEEP
24576:m3Bdco8g+Jw+uIWdSNmppQIAni/mqjGYqXGkICzZ+apKOiz4GvaG/9jhNpNbWOAD:sxpxIGJppQIAni/mqjGYqXGbuZ+apKO/
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-