amadey

General

Target

Latest_Setup.exe
Size

26.2MB
Sample

230726-247lesha5t
MD5

a11be3a619ea9bd57949b1fd2854d9e6
SHA1

b00005ed81e9af1ea4eddfc0af581a2b5d037157
SHA256

6ec3f402273407765765c3180937bb586580eb4de9ae774bdeaf96c05e9b770c
SHA512

ba88bb00e00837e2bce0774654ae04ac6b353081101ee26ff1dabbd3a95aebfe143fff0419910cf5db53207b6a0c89e5751985768323d42e5c0d84aafbe5036f
SSDEEP

393216:i5M3YIDtcVVPJtb4SRQ723+fJz/rvzf0xwNslaU6JTbj2Dr/RIoaIKOghXzDFGfw:dZqJT4f1rvLKs2anrRjI5gd9MLl+

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.166/b7djSDcPcZ/index.php

45.9.74.141/b7djSDcPcZ/index.php

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

- Target
  
  Latest_Setup.exe
- Size
  
  26.2MB
- MD5
  
  a11be3a619ea9bd57949b1fd2854d9e6
- SHA1
  
  b00005ed81e9af1ea4eddfc0af581a2b5d037157
- SHA256
  
  6ec3f402273407765765c3180937bb586580eb4de9ae774bdeaf96c05e9b770c
- SHA512
  
  ba88bb00e00837e2bce0774654ae04ac6b353081101ee26ff1dabbd3a95aebfe143fff0419910cf5db53207b6a0c89e5751985768323d42e5c0d84aafbe5036f
- SSDEEP
  
  393216:i5M3YIDtcVVPJtb4SRQ723+fJz/rvzf0xwNslaU6JTbj2Dr/RIoaIKOghXzDFGfw:dZqJT4f1rvLKs2anrRjI5gd9MLl+
Score

10^/10

amadey lumma sectoprat systembc evasion persistence rat spyware stealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1