General

  • Target

    file.exe

  • Size

    4.3MB

  • Sample

    230624-aawhhshd54

  • MD5

    12dc82a693eb598eb3aa521ffe54dc77

  • SHA1

    f572e6ab69a35c374e8f8fba29f1b2d56972c9b2

  • SHA256

    7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad

  • SHA512

    b893c111eea7dd9ac358f8a664e9d28edb97e467e94b035412d7e3bf03ac27d8ac3d9fc4a89fc60a0481ae01a5e26f13956b0d43288e8f899784be87db87dda2

  • SSDEEP

    98304:pZ8hpFxCj6kwJqphl6hBpNjPb2TX2LWMBL/m:pZCC5pP6h5TyD2LWMBT

Malware Config

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file.exe

    • Size

      4.3MB

    • MD5

      12dc82a693eb598eb3aa521ffe54dc77

    • SHA1

      f572e6ab69a35c374e8f8fba29f1b2d56972c9b2

    • SHA256

      7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad

    • SHA512

      b893c111eea7dd9ac358f8a664e9d28edb97e467e94b035412d7e3bf03ac27d8ac3d9fc4a89fc60a0481ae01a5e26f13956b0d43288e8f899784be87db87dda2

    • SSDEEP

      98304:pZ8hpFxCj6kwJqphl6hBpNjPb2TX2LWMBL/m:pZCC5pP6h5TyD2LWMBT

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies security service

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Modifies boot configuration data using bcdedit

    • XMRig Miner payload

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks