amadey

General

Target

Setup_Installer_Use_224466_As_PassWord.rar
Size

23.3MB
Sample

230729-pp9q1scg28
MD5

62a684e8fcaf42e9cc880b58a9c87372
SHA1

cce3635dee512efd2fa83a1d08be7ba51d4dce93
SHA256

83f6d9721abac7afdb48fad8a0430fcbb6cb4c1de28e37a0768d92cf8e7c8cda
SHA512

effbc9501bea501361b31af5157095099b27d350a51ae302321c1989b504cab7eddd2e8787778b682de7592c607265298c3e17751fb01986f9576a8c7679f8e2
SSDEEP

393216:yfA3DExfPHwy1lBBwxOEtR21PV3sV09GRI+iKTdZ4ZpuWDP4RvmlB87V:yf3RPp7IxOEtR28ViG+TKBZ47tP4U7IV

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.166/b7djSDcPcZ/index.php

45.9.74.141/b7djSDcPcZ/index.php

Extracted

Family

vidar

Version

4.9

Botnet

https://t.me/dastantim

C2

https://t.me/dastantim

https://steamcommunity.com/profiles/76561199529242058

Attributes

profile_id_v2
https://t.me/dastantim
user_agent
Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Targets

- Target
  
  FillInfoFile.txt
- Size
  
  465KB
- MD5
  
  ea5cd079095cee4c7e15a271d4b269d0
- SHA1
  
  ea1be6a90782c5de4348dba51f51e7c7dd35e8a4
- SHA256
  
  772b2c2d82d7e8b73c0b3b94fea283566eec241b98f802d71f5c6443fa96b75e
- SHA512
  
  699cede8419ef277794ae06f031621798816932cd463e230b9fd172f8ffaea2ff353beec2336bf8fac915adde2f1d75ac4569847e6423953d38d877735286df3
- SSDEEP
  
  192:gRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRI:n
Score

1^/10
behavioral1
- Target
  
  Setup-File.exe
- Size
  
  28.1MB
- MD5
  
  9ddc92ae27b3c01abcc9361f5f10dbeb
- SHA1
  
  4ae7273d55275c53ebd66fd8d55d54d5257ad21d
- SHA256
  
  48987d9c89542a8cb4f8d34eb34902a4762cc8643c0e491deb6115907db4887b
- SHA512
  
  20f81c7cf228b92ef488fc24d1a3ed288f77036903bfcb1a650a7505a9f618c2fafa09e4b7c5e539a5627d6436f7011f1ed0ecf027609524006c07716447e68b
- SSDEEP
  
  786432:z6FQ28LUo3oaouyd+sP6qSwbJ+IViZRR/5PwUA1:zAQPLUcoMA+sP6q3pV255rI
Score

10^/10

amadey lumma vidar https://t.me/dastantim spyware stealer trojan vmprotect
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral2