amadey

Sharing

General

Target

04715d62cf6ceef23e91e164233d5ea2e82a22024fa8d5fedab310fef9f911f3
Size

271KB
Sample

230910-136r3abh87
MD5

b4aeb6d3219f7f6bce12e046d71f682f
SHA1

3d262f9cf5e75a5d76f37682f7a6a0a9e4b1604d
SHA256

04715d62cf6ceef23e91e164233d5ea2e82a22024fa8d5fedab310fef9f911f3
SHA512

adfec5cf1f4e1a5d202919d6a726a81c1edc8979de980ec679450c1491bd52831b8710f59cde2cb685c7a3ea4cc35f6a7b0d6a3c8776b73016af7daa4a528866
SSDEEP

6144:UovtLnVRCo+AVsmm8cnggjM/B9HUq0WFH:Uo17VRCBxf8cn8Z9HFNF

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Extracted

Family

amadey

Version

3.87

http://79.137.192.18/9bDc8sQ/index.php

Attributes

install_dir
577f58beff
install_file
yiueea.exe
strings_key
a5085075a537f09dec81cc154ec0af4d

rc4.plain

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

http://zexeq.com/raud/get.php

Attributes

extension
.hgew
offline_id
Nk8w6hJsuGrE3s2SYWM3ehMUHvjgVRqqgX84dat1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iTbDHY13BX Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0780JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

amadey_api

amadapi.tuktuk.ug:11290

Attributes

auth_value
a004bea47cf55a1c8841d46c3fe3e6f5

Extracted

Family

laplas

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Extracted

Family

redline

Botnet

smokiez_build

194.169.175.232:45450

Attributes

auth_value
2e68bc276986767f0f14a3d75567abcd

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.38.95.107:42494

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Targets

- Target
  
  04715d62cf6ceef23e91e164233d5ea2e82a22024fa8d5fedab310fef9f911f3
- Size
  
  271KB
- MD5
  
  b4aeb6d3219f7f6bce12e046d71f682f
- SHA1
  
  3d262f9cf5e75a5d76f37682f7a6a0a9e4b1604d
- SHA256
  
  04715d62cf6ceef23e91e164233d5ea2e82a22024fa8d5fedab310fef9f911f3
- SHA512
  
  adfec5cf1f4e1a5d202919d6a726a81c1edc8979de980ec679450c1491bd52831b8710f59cde2cb685c7a3ea4cc35f6a7b0d6a3c8776b73016af7daa4a528866
- SSDEEP
  
  6144:UovtLnVRCo+AVsmm8cnggjM/B9HUq0WFH:Uo17VRCBxf8cn8Z9HFNF
Score

10^/10

amadey djvu laplas redline smokeloader amadey_api backdoor clipper discovery evasion infostealer persistence ransomware stealer trojan logsdiller cloud (tg: @logsdillabot)smokiez_build
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Laplas Clipper
  Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
  stealer clipper laplas
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2