General
-
Target
setup.exe
-
Size
1.1MB
-
Sample
230418-af2lqaac8x
-
MD5
1216bff1672dca0debcc4dd083fd94d9
-
SHA1
1fe22309e20363091d6fd6c2a048abd08b25f7af
-
SHA256
a72c8b3902c5b0263e34314292e5a05e1b732d012f75117ad6557911012fd033
-
SHA512
f5439ed0713679540dd0d663c8300b70c26e8b67ff4b063e5c3889768ffa4fd3852f3aaac5f7055b2e757e1206fd2a3b192f10c4840908c843d5a6346537058b
-
SSDEEP
24576:ky0PaWn8FHk6YTC2O9xkDEX5nGInudmfJ:z0PaXHk6P9CDE8SBf
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Extracted
icarusstealer
5.75.162.221
-
payload_url
http://193.31.116.239/crypt/public/Update_Downloads/patata.jpg
Targets
-
-
Target
setup.exe
-
Size
1.1MB
-
MD5
1216bff1672dca0debcc4dd083fd94d9
-
SHA1
1fe22309e20363091d6fd6c2a048abd08b25f7af
-
SHA256
a72c8b3902c5b0263e34314292e5a05e1b732d012f75117ad6557911012fd033
-
SHA512
f5439ed0713679540dd0d663c8300b70c26e8b67ff4b063e5c3889768ffa4fd3852f3aaac5f7055b2e757e1206fd2a3b192f10c4840908c843d5a6346537058b
-
SSDEEP
24576:ky0PaWn8FHk6YTC2O9xkDEX5nGInudmfJ:z0PaXHk6P9CDE8SBf
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
IcarusStealer
Icarus is a modular stealer written in C# First adverts in July 2022.
-
Modifies Windows Defender Real-time Protection settings
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-