amadey

Sharing

General

Target

67852290ed00753b1cd7e489620f6d0a76409c90a62eb3996b7526f4377fac74
Size

249KB
Sample

230330-a44e8aca7x
MD5

568b15f62c8cfd2cfd9d8be6c029d9cf
SHA1

f4f71c4339f638d68a40c16ab9b45f166ae98639
SHA256

67852290ed00753b1cd7e489620f6d0a76409c90a62eb3996b7526f4377fac74
SHA512

3458c4f808661387683d4a498e2a81a20cda56a772cb8b8364f4351bc4f10b77b7be8bf6aaefd01c3a807a6e1d4fc98f9c05dc9828923757c907cef23f7cecf2
SSDEEP

3072:BbcajFoZN8XZjlmgLCLcnfPrE6GDetnP25vDWbMSLiButE/hjCyCB4GsU4xAr+:xnjqMZjlXLC4fPY6RP4vpnVjdG4S+

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/test2/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.jywd
offline_id
MEMHlobHgXqvmTWaMsLcwGZhDOd00bblO1yevst1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fkW8qLaCVQ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0675JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

ROBER

138.201.195.134:15564

Attributes

auth_value
de311ede2b43457816afc0d9989c5255

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

vidar

Version

3.2

Botnet

5df88deb5dde677ba658b77ad5f60248

https://steamcommunity.com/profiles/76561199489580435

https://t.me/tabootalks

Attributes

profile_id_v2
5df88deb5dde677ba658b77ad5f60248
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 OPR/91.0.4516.79

Targets

- Target
  
  67852290ed00753b1cd7e489620f6d0a76409c90a62eb3996b7526f4377fac74
- Size
  
  249KB
- MD5
  
  568b15f62c8cfd2cfd9d8be6c029d9cf
- SHA1
  
  f4f71c4339f638d68a40c16ab9b45f166ae98639
- SHA256
  
  67852290ed00753b1cd7e489620f6d0a76409c90a62eb3996b7526f4377fac74
- SHA512
  
  3458c4f808661387683d4a498e2a81a20cda56a772cb8b8364f4351bc4f10b77b7be8bf6aaefd01c3a807a6e1d4fc98f9c05dc9828923757c907cef23f7cecf2
- SSDEEP
  
  3072:BbcajFoZN8XZjlmgLCLcnfPrE6GDetnP25vDWbMSLiButE/hjCyCB4GsU4xAr+:xnjqMZjlXLC4fPY6RP4vpnVjdG4S+
Score

10^/10

amadey djvu redline smokeloader vidar 5df88deb5dde677ba658b77ad5f60248 pub1 rober backdoor discovery infostealer persistence ransomware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1