General
-
Target
033bbc64f889777be17fa5bc28439d1ee79c94a611a58853790eb865c7d87d54.zip
-
Size
1.0MB
-
Sample
230321-rvg93ada41
-
MD5
c21780642c720c1f8abf585e6ad3e0ee
-
SHA1
00977f266219faf1aa1879f7213bf4931d7f16bc
-
SHA256
591dc1de5fa44eb8ff1aa051e47064b70b3777bcead66b2a99d7ea0be99a9e3e
-
SHA512
c6a48b14ed2a86f7481d8806c11461da1f8ee316b6a40c8229aac240b738ef103242f35d932553cc7de493dc11665e62eb48cc8b0e8d8d7071721d75324709d0
-
SSDEEP
24576:P7lmNIFktx+pxpvhKM9GIMZQWRwO3MADNlSsy:z5xpvYXIVaMClSsy
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Targets
-
-
Target
033bbc64f889777be17fa5bc28439d1ee79c94a611a58853790eb865c7d87d54.exe
-
Size
1.4MB
-
MD5
056d809fc0b3e0af97316dbfbba1481e
-
SHA1
9083da544ba4653ca83df9dc04968e0d084f7cfb
-
SHA256
033bbc64f889777be17fa5bc28439d1ee79c94a611a58853790eb865c7d87d54
-
SHA512
a9e1a5aeea7959e819c34a90673b1086b1c61ac2fa3279798b56991885b203530398aba290e8b2e2eb3f6967b337b24e18c25b085e4fdd4236ef663fdcb21545
-
SSDEEP
24576:j3Bdco8g+Jw+uIWdSNmppQIAni/mqjGYqXGkICzZ+apKOiz4GvaG/9jhNpNbWOAD:fxpxIGJppQIAni/mqjGYqXGbuZ+apKO/
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-