Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1aebf6a1a305f1040ea16c21c143697f7c76277c8a957691d25698db30a971b6

  • Size

    7.5MB

  • Sample

    230801-ef4hjaec4z

  • MD5

    5e46cc22ddf121ab4001ee5ee664d376

  • SHA1

    cd0475812d4a0b2398beea77dd865e514262635d

  • SHA256

    1aebf6a1a305f1040ea16c21c143697f7c76277c8a957691d25698db30a971b6

  • SHA512

    63b5ec2dced11380f208ba88ab1a11b9cb347436291e5d03787c2655f6126a33c9ed2cc958f50c00e315ec44be6f25a19a36539f51e48b3849a051ab23b24354

  • SSDEEP

    196608:PoCKFCGSiWz3WsiOL95v55+GHncYSxK+TW+sE4m3pk:QCKkeWixOnx5K8WW+0Wu

Score
10/10
amadeysectopratsystembcpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.166/b7djSDcPcZ/index.php

45.9.74.141/b7djSDcPcZ/index.php

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

    • Target

      1aebf6a1a305f1040ea16c21c143697f7c76277c8a957691d25698db30a971b6

    • Size

      7.5MB

    • MD5

      5e46cc22ddf121ab4001ee5ee664d376

    • SHA1

      cd0475812d4a0b2398beea77dd865e514262635d

    • SHA256

      1aebf6a1a305f1040ea16c21c143697f7c76277c8a957691d25698db30a971b6

    • SHA512

      63b5ec2dced11380f208ba88ab1a11b9cb347436291e5d03787c2655f6126a33c9ed2cc958f50c00e315ec44be6f25a19a36539f51e48b3849a051ab23b24354

    • SSDEEP

      196608:PoCKFCGSiWz3WsiOL95v55+GHncYSxK+TW+sE4m3pk:QCKkeWixOnx5K8WW+0Wu

    Score
    10/10
    amadeysectopratsystembcpersistenceratspywarestealerthemidatrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Arechclient2 RAT

      Arechclient2.

    • Detects DLL dropped by Raspberry Robin.

      Raspberry Robin.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks