amadey

Sharing

Copy URL Twitter E-mail

General

Target

88358b698bfd76b4f70d68b8a.exe
Size

240KB
Sample

230704-p8bnbsdb84
MD5

4040afcf9849e20e9305eb95cdd68ccc
SHA1

79b900321e613d55e919516e6db4e7d8d153ad1c
SHA256

88358b698bfd76b4f70d68b8a58bb054ff818f427b5499c77c700d56e0cf8c6f
SHA512

5b54ab86523559476bd3bf8e5ab17c001cae57f102b86e8f87cc61ad54a4b48e2a14e7c0fc50dad601d5b6b63eb84be0e50828a267fd22358d83f60f3258b3fb
SSDEEP

3072:VXZH5ILJTOEdHJjsU5wisOrB8i11stWRlmqsyO27hZY:RoL9nJwxiLtvFSz0ZY

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

http://zexeq.com/raud/get.php

Attributes

extension
.agpo
offline_id
IGjpno8dwAKJpBjbvlsxfyQXyNoBoo3dXUtMk6t1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-3OsGArf4HD Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0736JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

drweb

45.15.156.21:15863

Attributes

auth_value
949031ad787e9a67fa3ef65b4056842b

Extracted

Family

amadey

Version

3.83

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

vidar

Version

4.6

Botnet

dcad9d884915bbb6106f78e5e2ea6168

https://steamcommunity.com/profiles/76561199523054520

https://t.me/game4serv

Attributes

profile_id_v2
dcad9d884915bbb6106f78e5e2ea6168
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

Extracted

Family

redline

Botnet

020723_rc_11

newfk.tuktuk.ug:11285

Attributes

auth_value
7844691e7577455d1a963fbaa7d4006a

Extracted

Family

smokeloader

Botnet

up3

Targets

- Target
  
  88358b698bfd76b4f70d68b8a.exe
- Size
  
  240KB
- MD5
  
  4040afcf9849e20e9305eb95cdd68ccc
- SHA1
  
  79b900321e613d55e919516e6db4e7d8d153ad1c
- SHA256
  
  88358b698bfd76b4f70d68b8a58bb054ff818f427b5499c77c700d56e0cf8c6f
- SHA512
  
  5b54ab86523559476bd3bf8e5ab17c001cae57f102b86e8f87cc61ad54a4b48e2a14e7c0fc50dad601d5b6b63eb84be0e50828a267fd22358d83f60f3258b3fb
- SSDEEP
  
  3072:VXZH5ILJTOEdHJjsU5wisOrB8i11stWRlmqsyO27hZY:RoL9nJwxiLtvFSz0ZY
Score

10^/10

smokeloader backdoor trojan amadey djvu fabookie gcleaner redline vidar 020723_rc_11 dcad9d884915bbb6106f78e5e2ea6168 drweb pub1 up3 discovery evasion infostealer loader persistence ransomware spyware stealer themida
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- Executes dropped EXE
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detect Fabookie payload

Detected Djvu ransomware

Djvu Ransomware

Fabookie

GCleaner

RedLine

SmokeLoader

Vidar

Downloads MZ/PE file

Stops running service(s)

Executes dropped EXE

Modifies file permissions

Themida packer

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2