amadey

Sharing

Copy URL

Twitter E-mail

General

Target

d372519f0ebd015c785688ffd6dd393627608b9ae4a039d523531f07cc820cf0
Size

325KB
Sample

231025-24fspshf2y
MD5

8e7e8b68e45beaf9e8b7ae01af67ad63
SHA1

e720443972069ac7086103cfdf4c0e371bc819b7
SHA256

4b94273ecb670e4d09a7c896978adca28c0bcbe8295a719f1b2c75dc87d150d2
SHA512

579edba25bbcac66378d3713612d58085560b3923a6f50c120ae1be904e6ed4ae0c48d53fce6432e7b0d075cc0e5d0aed5a0e33a45d33f720f0495fbfa24ea81
SSDEEP

6144:s06cuvfIwAKBrkQO70qB7R+gz62SVyLzsYTg+BKIV2PNenJs1Zu:zNwfBrK0g7z6XIjV2PIP

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

raccoon

Botnet

6a6a005b9aa778f606280c5fa24ae595

http://195.123.218.98:80

http://31.192.23

Attributes

user_agent
SunShineMoonLight

xor.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

89.23.100.93:4449

Mutex

oonrejgwedvxwse

Attributes

delay
1
install
true
install_file
calc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  d372519f0ebd015c785688ffd6dd393627608b9ae4a039d523531f07cc820cf0
- Size
  
  909KB
- MD5
  
  07e934c12d2ee414f71e42894989552e
- SHA1
  
  9d1dbb82226c27c0c0b3826940e2718c50ee796e
- SHA256
  
  d372519f0ebd015c785688ffd6dd393627608b9ae4a039d523531f07cc820cf0
- SHA512
  
  b712348dca5cb7c5a31ca829f343bb45fa369f08f5c96d51e325266a09177dca233ce6c855fcba9f8b50b76dabf91ac840b730dab9b64df944d4ff8ca18e0ce3
- SSDEEP
  
  12288:jH1y57Fa2dALbyZa5uHZ/LiaQZKmRuUDm2r+Wg5ukiSkEy:oE2dALbyZa5uHZcQmRbVoL
Score

10^/10

amadey dcrat glupteba phobos raccoon redline rhadamanthys smokeloader zgrat 6a6a005b9aa778f606280c5fa24ae595 grome kinza up3 backdoor google collection discovery dropper evasion infostealer loader persistence phishing ransomware rat rootkit spyware stealer trojan asyncrat default
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect ZGRat V1
- Detect rhadamanthys stealer shellcode
- Detected google phishing page
  phishing google
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Async RAT payload
  rat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Manipulates WinMon driver.
  Roottkits write to WinMon to hide PIDs from being detected.
  rootkit evasion
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2