amadey

General

Target

8498a90e5079ab50533e2471231b044e.exe
Size

271KB
Sample

230629-2hyfmagc31
MD5

8498a90e5079ab50533e2471231b044e
SHA1

2beae16d2f563c4d48502b72cb11f4247995790f
SHA256

97ab7127415539a6b8bdc06b8eb7089a1add34b62d1026f94b8f5c4efe393f19
SHA512

639b03749871bcdb1f29560920f6dac1c89bd549084b9c60d958908d13c01acd672cc6574942e301f6f4ac6cb6c0db91b458546116dc38f2ac9785863ac3e45c
SSDEEP

3072:o82arJnmvhgShgPeWJdyOraKE8k6q3CP2VgiLKqu1:tRpShgPeWqOeKhk6qk2Vgi

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.agvv
offline_id
IGjpno8dwAKJpBjbvlsxfyQXyNoBoo3dXUtMk6t1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-3OsGArf4HD Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0737JOsie

rsa_pubkey.plain

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  8498a90e5079ab50533e2471231b044e.exe
- Size
  
  271KB
- MD5
  
  8498a90e5079ab50533e2471231b044e
- SHA1
  
  2beae16d2f563c4d48502b72cb11f4247995790f
- SHA256
  
  97ab7127415539a6b8bdc06b8eb7089a1add34b62d1026f94b8f5c4efe393f19
- SHA512
  
  639b03749871bcdb1f29560920f6dac1c89bd549084b9c60d958908d13c01acd672cc6574942e301f6f4ac6cb6c0db91b458546116dc38f2ac9785863ac3e45c
- SSDEEP
  
  3072:o82arJnmvhgShgPeWJdyOraKE8k6q3CP2VgiLKqu1:tRpShgPeWqOeKhk6qk2Vgi
Score

10^/10

smokeloader backdoor trojan amadey djvu fabookie pub1 discovery ransomware spyware stealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2