amadey

General

Target

dd30198ea41d5015bbb55030481bee96.bin
Size

151KB
Sample

230610-c1gs6aea89
MD5

7df144cf459380322cad6045f03c9bd7
SHA1

aaa99afdfbac718499e91c06d0b9cf33bcf910d8
SHA256

153f543e7aa3e1ecd1e64154684547c4c516454b410bbab1793907271cc18f37
SHA512

dc57be740653a16d6f4db122eb05d299aaf4999a5ef944aeb532337aea30dd0f8297de589179366b6f2a7d59bed25eb0b27717416f70e35fb67f719a6afd87c7
SSDEEP

3072:mvp0TsiVzUSv6JJC+JdSiwpJiQdPeQ+ui/4+JyRq3VWfrCBcpLp8RZwjj:gq4iJUSv6aT7iQdmQu/GrwRZC

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://toobussy.com/tmp/

http://wuc11.com/tmp/

http://ladogatur.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.ahui
offline_id
vPWUuYIO6Lzy2cGt8zL7FERKTf4QMBPjn7F005t1
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-sLaQRb9N6e Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0728Isk

rsa_pubkey.plain

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

vidar

Version

4.2

Botnet

a81bcf59d85e6e13257840e65b9d1da8

C2

https://steamcommunity.com/profiles/76561199511129510

https://t.me/rechnungsbetrag

Attributes

profile_id_v2
a81bcf59d85e6e13257840e65b9d1da8
user_agent
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.38 Safari/537.36 Brave/75

Targets

- Target
  
  69ab392dfe42b299677871707364b4b59da9a4e466eda0065db4dc6da89f9321.exe
- Size
  
  276KB
- MD5
  
  dd30198ea41d5015bbb55030481bee96
- SHA1
  
  14c16216f39e98e509e1e2025bb0413fa1ecc3aa
- SHA256
  
  69ab392dfe42b299677871707364b4b59da9a4e466eda0065db4dc6da89f9321
- SHA512
  
  b2be031819f002c72a0fbc1ad5e4eeff4968a33fbb8dba8b3ad4bf1bfba2cbe6882cc6f5025cbf55643f1c799bd07a56761d0697ebceec496d28bf40a8dd1dbe
- SSDEEP
  
  3072:wCdRiliZsfO/cYB11Y0s78Qu+EI6w5Xjy3GjSPOVGfLBrje057oJRR:1RilhO/cYB1m78Q12wdjlSAG1rjUv
Score

10^/10

smokeloader backdoor trojan amadey djvu fabookie vidar a81bcf59d85e6e13257840e65b9d1da8 pub1 discovery persistence ransomware spyware stealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2