amadey

General

Target

b7578171f9622fe509960bbd05214a6c.bin
Size

147KB
Sample

230605-pk2jvaha9z
MD5

4cb0538b75360c884bd09eac2e32301e
SHA1

ed5f55c55c9cff7b5ac668251e73fd8beadf42ae
SHA256

7c9b70a2a5a2973c187221d35d93ab7b02c0328e889e5542edd1774f893afa5f
SHA512

afc9385461f3a24ee2f3c0c3760a7a38333b6cdd52836815de16675f9c649b47ef161fee8f990171a5edac8f88e2a3c067b503d2112deecd937479185254544f
SSDEEP

3072:O66TfbEUJLbbYzRZEF7qxh+F+UOOJYj1yuvVgNtxrBcd4B/qP6:efbEUJXbYzgFV+uQvdg7x9c406

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://toobussy.com/tmp/

http://wuc11.com/tmp/

http://ladogatur.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.neon
offline_id
0vTA6MA1m5nzrdffOCJC7YmAa4Lp6YNN8lOJ4mt1
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-vc50LyB2yb Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0725JOsie

rsa_pubkey.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

vidar

Version

4.1

Botnet

77a63e71a10ee1d81a28b5c866b75922

C2

https://steamcommunity.com/profiles/76561199510444991

https://t.me/task4manager

Attributes

profile_id_v2
77a63e71a10ee1d81a28b5c866b75922
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Extracted

Family

amadey

Version

3.67

C2

45.9.74.80/0bjdn2Z/index.php

Targets

- Target
  
  c2a2a609fd72d55c11f810577c29c7d85f92da64ac1594420fc32eb2f5a5ddb4.exe
- Size
  
  238KB
- MD5
  
  b7578171f9622fe509960bbd05214a6c
- SHA1
  
  3e948e7ac1b875d9ae872b81a22b32d50462a16a
- SHA256
  
  c2a2a609fd72d55c11f810577c29c7d85f92da64ac1594420fc32eb2f5a5ddb4
- SHA512
  
  a6d259daccbe9dfab152bac724a8076c25f4390af58b032b774064337adc2f058585a312bd171f6328c967597dcdb322c6d2787a2ad6844e278828032162c8c2
- SSDEEP
  
  3072:3YwntPUA9qu8aStIqeUjPKvDvHh78QahnQD/7vTgB1CzSXauBtO4:ImPUAWt3eU2vDvH6QzD/zkkej
Score

10^/10

smokeloader backdoor trojan amadey djvu fabookie vidar 77a63e71a10ee1d81a28b5c866b75922 pub1 discovery persistence ransomware spyware stealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2