amadey

General

Target

673192e23603b5a23173abeb594103e7babf154eb3af5288ccfb0fa6db6eacf5
Size

619KB
Sample

230903-1wl43scc7t
MD5

06add227c345dd1c1431948aa14daa60
SHA1

997d37b60d2760f9c7a39f69bdc682ced0f61453
SHA256

673192e23603b5a23173abeb594103e7babf154eb3af5288ccfb0fa6db6eacf5
SHA512

0070004fb3cceacb670bf9ee38159c52782e367357ddd360ee4685de1829a92083ea7d62a131778dd9c68b4f3f455b28b2ec63e5e3bb8a5b7979c45a7c1f67dd
SSDEEP

12288:/F+sUVFY9mukbdejkPjIQ65D5zgXQCR4MZ/R3rAKyX:/FsVi9mxbkjkPjIQLX9TVKKg

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Extracted

Family

redline

Botnet

010923

C2

happy1sept.tuktuk.ug:11290

Attributes

auth_value
8338bf26f599326ee45afe9d54f7ef8e

Targets

- Target
  
  673192e23603b5a23173abeb594103e7babf154eb3af5288ccfb0fa6db6eacf5
- Size
  
  619KB
- MD5
  
  06add227c345dd1c1431948aa14daa60
- SHA1
  
  997d37b60d2760f9c7a39f69bdc682ced0f61453
- SHA256
  
  673192e23603b5a23173abeb594103e7babf154eb3af5288ccfb0fa6db6eacf5
- SHA512
  
  0070004fb3cceacb670bf9ee38159c52782e367357ddd360ee4685de1829a92083ea7d62a131778dd9c68b4f3f455b28b2ec63e5e3bb8a5b7979c45a7c1f67dd
- SSDEEP
  
  12288:/F+sUVFY9mukbdejkPjIQ65D5zgXQCR4MZ/R3rAKyX:/FsVi9mxbkjkPjIQLX9TVKKg
Score

10^/10

amadey fabookie glupteba laplas clipper discovery dropper evasion loader persistence rootkit spyware stealer trojan redline 010923 infostealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Laplas Clipper
  Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
  stealer clipper laplas
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Modifies boot configuration data using bcdedit
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMon driver.
  Roottkits write to WinMon to hide PIDs from being detected.
  rootkit evasion
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2