amadey

General

Target

12dc82a693eb598eb3aa521ffe54dc77.bin
Size

3.9MB
Sample

230626-bdawnafd68
MD5

8ca0a189d5ee54533ca29fe6ee8a50d5
SHA1

b728083c60830f98deefd3bed307ab5320a9e5a3
SHA256

307c3e20e65556cfe4c2c0e0864a6b71fe0bb56cf8c3e1fc26890cf849925705
SHA512

c9550fa42b5a501a1c30ce9b13cb3bd02170d455c219fd0db5fb64f7bc27045348c72e2e10cb5d488396c6c62df36f5bbd0aa7730c5c096bdc518f1c6bcb2ff8
SSDEEP

98304:0M7D+OFUg0qT2h57pxMKPx6FOimQzHbeyGpNFtU4s5xWyBrhKGW0r:h+HZR5XMKPgOimQzHDsNbmtf9r

Malware Config

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

240623_rcn_11

C2

rcn.tuktuk.ug:11285

Attributes

auth_value
c3b2a1ea22f94130d13c3d3e2ab4dedf

Targets

- Target
  
  7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe
- Size
  
  4.3MB
- MD5
  
  12dc82a693eb598eb3aa521ffe54dc77
- SHA1
  
  f572e6ab69a35c374e8f8fba29f1b2d56972c9b2
- SHA256
  
  7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad
- SHA512
  
  b893c111eea7dd9ac358f8a664e9d28edb97e467e94b035412d7e3bf03ac27d8ac3d9fc4a89fc60a0481ae01a5e26f13956b0d43288e8f899784be87db87dda2
- SSDEEP
  
  98304:pZ8hpFxCj6kwJqphl6hBpNjPb2TX2LWMBL/m:pZCC5pP6h5TyD2LWMBT
Score

10^/10

amadey fabookie gcleaner glupteba redline smokeloader 240623_rcn_11 up3 backdoor discovery dropper evasion infostealer loader persistence rootkit spyware stealer trojan upx xmrig miner
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies security service
  evasion
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies boot configuration data using bcdedit
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Manipulates WinMon driver.
  Roottkits write to WinMon to hide PIDs from being detected.
  rootkit evasion
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2