amadey

General

Target

file.exe
Size

241KB
Sample

230710-thb9dsda2v
MD5

59b74a5c0c79e277b6e9fe6814f91aa8
SHA1

83be9e3d38b6223c256babaa80f2945e53e1954a
SHA256

ad3de13de28407363e7200a8e71a42acad55fd725a477558d19cac5e021ecd70
SHA512

91ff633bd354e18b632bd602faee5c6898409b9057da6b909e91d457dd1e19376ab8b96d0cdbc22e677239d7140db3a6dd02168e40d431a1c623e983040eacd8
SSDEEP

3072:5InLsdvCVrFBXsuSB6Hy3wlip43WyruQY/z1:OnLssbpszjjPyNYr

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/

rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.gayn
offline_id
idjLJVXs65t0hiY0Usr4A1G0xEEwvvs9JcZKN0t1
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ZyZya4Vb8D Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0743JOsie

rsa_pubkey.plain

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Targets

- Target
  
  file.exe
- Size
  
  241KB
- MD5
  
  59b74a5c0c79e277b6e9fe6814f91aa8
- SHA1
  
  83be9e3d38b6223c256babaa80f2945e53e1954a
- SHA256
  
  ad3de13de28407363e7200a8e71a42acad55fd725a477558d19cac5e021ecd70
- SHA512
  
  91ff633bd354e18b632bd602faee5c6898409b9057da6b909e91d457dd1e19376ab8b96d0cdbc22e677239d7140db3a6dd02168e40d431a1c623e983040eacd8
- SSDEEP
  
  3072:5InLsdvCVrFBXsuSB6Hy3wlip43WyruQY/z1:OnLssbpszjjPyNYr
Score

10^/10

smokeloader backdoor trojan amadey djvu fabookie summ discovery ransomware spyware stealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2