Overview

overview

10

Static

static

7

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

  • Size

    6.5MB

  • Sample

    230728-d4ryzabb35

  • MD5

    047b5d2075c2d6610b0b63c34d0455be

  • SHA1

    f5a29ddd6f1df5da62250f93094b754043cc586c

  • SHA256

    f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

  • SHA512

    6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

  • SSDEEP

    196608:ohcmcCw4eb7tPjA5rAoYpB+2u54AXDkQcRDt8yhm0FpGn:ohPcfDtPc5sXpB+2umGd4DthtFO

Score
10/10
amadeysectopratsystembcevasionpersistenceratthemidatrojanvmprotect

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.166/b7djSDcPcZ/index.php

45.9.74.141/b7djSDcPcZ/index.php

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

    • Target

      f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

    • Size

      6.5MB

    • MD5

      047b5d2075c2d6610b0b63c34d0455be

    • SHA1

      f5a29ddd6f1df5da62250f93094b754043cc586c

    • SHA256

      f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

    • SHA512

      6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

    • SSDEEP

      196608:ohcmcCw4eb7tPjA5rAoYpB+2u54AXDkQcRDt8yhm0FpGn:ohPcfDtPc5sXpB+2umGd4DthtFO

    Score
    10/10
    amadeytrojanvmprotectsectopratsystembcevasionpersistenceratthemida

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Arechclient2 RAT

      Arechclient2.

    • Detects DLL dropped by Raspberry Robin.

      Raspberry Robin.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks