General
-
Target
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.zip
-
Size
1.0MB
-
Sample
230321-rvjswsah82
-
MD5
61740c5cf10af9d2c3f6645910633147
-
SHA1
7e16bb3b780fc1b0dd072f0bd0e0792f2634a84c
-
SHA256
39f3763e35309aa55b43612ffc3113bb5d0cc7de2383dd5184a646420a47e889
-
SHA512
b941463e6e7f1feefe8ee56c8949ae66108cf23516bd748fb62fcd4e0d4c4368d7cf22ddd2bb56a75e30664f7e6b0b0037229582354cb66a3abbd4f15fb3efb6
-
SSDEEP
24576:GOMcvem3u/X4hq4U6jkhIxPUk+NvAfjPrPU27nshkzY7C:GDcvy/XoBohIxwNvGjPrPH7ng17C
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Targets
-
-
Target
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe
-
Size
1.4MB
-
MD5
0de84a66b983d2f407390473dd1e37de
-
SHA1
21de93ab0f4e6706403e0bd3167be9aa8178018b
-
SHA256
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969
-
SHA512
37fc3f31dbb2721565c56974638e483cf3700779b4bbe324c26dbf4f45721211516b041b519b63bd8feb653b8b1de6bda8c52736085f72ff597d5fcb8d839a94
-
SSDEEP
24576:m3Bdco8g+Jw+uIWdSNmppQIAni/mqjGYqXGkICzZ+apKOiz4GvaG/9jhNpNbWOAD:sxpxIGJppQIAni/mqjGYqXGbuZ+apKO/
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-