amadey

General

Target

setup_x86_x64_install.bin
Size

14.1MB
Sample

230710-qa9yxabe2z
MD5

aa581b1f07d2ab6bfff3134a307cec2e
SHA1

de449691f3489dd76b891434781b8753802eee14
SHA256

f114cbd90381a13d1f7fee0ff09a52e238a4451da70191a2adeccbf84817c61a
SHA512

b8553eecfa308ac4edbc90c565bfa01bef343ff2842f493e495672fabe11409c437fb07fce6296863b8e8363363a58638f900e6c4f3b06341913004f2f20277d
SSDEEP

196608:J+D/NGZ0gHyb1HMJPD/egwsjWIH4Aihj+avAs4Tt5Q9NCROf2s3Ak:JYNGLHs1wNw6WIHSvvApTyNCROf2s3Ak

Malware Config

Extracted

Family

socelars

C2

http://www.wgqpw.com/

Extracted

Family

redline

Botnet

@Bob

C2

185.215.113.44:23759

Attributes

auth_value
052aa6a199b3b3a78037547a0c15cdcf

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

redline

Botnet

media2test

C2

65.108.69.168:16278

Attributes

auth_value
f78d521ba2c4812c35b2d33300976a4e

Extracted

Family

amadey

Version

2.85

C2

185.215.113.35/d2VxjasuwS/index.php

Targets

- Target
  
  setup_x86_x64_install.bin
- Size
  
  14.1MB
- MD5
  
  aa581b1f07d2ab6bfff3134a307cec2e
- SHA1
  
  de449691f3489dd76b891434781b8753802eee14
- SHA256
  
  f114cbd90381a13d1f7fee0ff09a52e238a4451da70191a2adeccbf84817c61a
- SHA512
  
  b8553eecfa308ac4edbc90c565bfa01bef343ff2842f493e495672fabe11409c437fb07fce6296863b8e8363363a58638f900e6c4f3b06341913004f2f20277d
- SSDEEP
  
  196608:J+D/NGZ0gHyb1HMJPD/egwsjWIH4Aihj+avAs4Tt5Q9NCROf2s3Ak:JYNGLHs1wNw6WIHSvvApTyNCROf2s3Ak
Score

10^/10

amadey fabookie glupteba nullmixer redline smokeloader socelars @bob media2test pub5 aspackv2 backdoor discovery dropper evasion infostealer loader persistence rootkit spyware stealer trojan vidar
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Modifies boot configuration data using bcdedit
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Vidar Stealer
  stealer
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Manipulates WinMon driver.
  Roottkits write to WinMon to hide PIDs from being detected.
  rootkit evasion
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2