amadey

General

Target

6523.exe
Size

232KB
Sample

230514-rx6enscb73
MD5

d937bf5e62381717877134f8c3961421
SHA1

74405d9a2bf6163c69084566962eb170c3d348c9
SHA256

7eed06168ef0ddb3a6d968549840a906b25d633598cf37418dabba077c778273
SHA512

c2d4ba2b3f97ec6e2eb9dd47c0026b24c13ff9a5b5fed9effed887245db3e85dfe145ea473432c23b2e8dcc3981007e8faf910d31066c1c4f9607f0275afcf7c
SSDEEP

3072:1eqGEm9TivH0szvdrmZ6SUOtcT18/1MzL8Ww/dC4+CVb43W6AV2v4Oh6RB:sVfTuH0IvdrmZxU9a6ZCx3B

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://toobussy.com/tmp/

http://wuc11.com/tmp/

http://ladogatur.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

amadey

Version

3.70

C2

77.73.134.27/n9kdjc3xSf/index.php

Extracted

Family

djvu

C2

http://zexeq.com/lancer/get.php

Attributes

extension
.gatz
offline_id
gdTA3a9eBPJZlAHc7UhZKxuA2PF57q3j1xsfAkt1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-pznhigpUwP Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0705JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

3.8

Botnet

e5d7cb6205191dc1a4f6288000860943

C2

https://steamcommunity.com/profiles/76561198272578552

https://t.me/libpcre

Attributes

profile_id_v2
e5d7cb6205191dc1a4f6288000860943
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Targets

- Target
  
  6523.exe
- Size
  
  232KB
- MD5
  
  d937bf5e62381717877134f8c3961421
- SHA1
  
  74405d9a2bf6163c69084566962eb170c3d348c9
- SHA256
  
  7eed06168ef0ddb3a6d968549840a906b25d633598cf37418dabba077c778273
- SHA512
  
  c2d4ba2b3f97ec6e2eb9dd47c0026b24c13ff9a5b5fed9effed887245db3e85dfe145ea473432c23b2e8dcc3981007e8faf910d31066c1c4f9607f0275afcf7c
- SSDEEP
  
  3072:1eqGEm9TivH0szvdrmZ6SUOtcT18/1MzL8Ww/dC4+CVb43W6AV2v4Oh6RB:sVfTuH0IvdrmZxU9a6ZCx3B
Score

10^/10

amadey djvu smokeloader vidar e5d7cb6205191dc1a4f6288000860943 pub1 backdoor discovery ransomware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Modifies file permissions
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1