General
-
Target
0de84a66b983d2f407390473dd1e37de.bin
-
Size
1.0MB
-
Sample
230322-bc823aga3s
-
MD5
389ccf32904a3cbb433ce099d9512383
-
SHA1
f515f96b6fbecc51c036139fcd24f519d878ccf7
-
SHA256
c087c74fdebee5ea5f8c48b9de9af3a8daedadbf4d3862cd9b4bdb80b955985f
-
SHA512
5788184b5d66872a7ecbfb0189daae28a5eb16b95474a8c87984ca1f8a87750fb672cdd4c19ec3c9c4dd9005af4c6a9515a8ba5fe426578dcaac2b5aeb924a99
-
SSDEEP
24576:aYwFJh9IEWi38iqWOQ5l/PGpd1tPfJem3eNb:a/Jh9I5Wv/2Ut
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Targets
-
-
Target
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe
-
Size
1.4MB
-
MD5
0de84a66b983d2f407390473dd1e37de
-
SHA1
21de93ab0f4e6706403e0bd3167be9aa8178018b
-
SHA256
e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969
-
SHA512
37fc3f31dbb2721565c56974638e483cf3700779b4bbe324c26dbf4f45721211516b041b519b63bd8feb653b8b1de6bda8c52736085f72ff597d5fcb8d839a94
-
SSDEEP
24576:m3Bdco8g+Jw+uIWdSNmppQIAni/mqjGYqXGkICzZ+apKOiz4GvaG/9jhNpNbWOAD:sxpxIGJppQIAni/mqjGYqXGbuZ+apKO/
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-