amadey

General

Target

c08eee0129f5e63f5226ff413a14a442cd931290cfcac55e2192a704eff63562
Size

288KB
Sample

231125-2vgcwadd54
MD5

0e609e4681b1b5244aed42409f22d19c
SHA1

9b0627a36900165af87270a52c6eb07d30e9fa43
SHA256

c08eee0129f5e63f5226ff413a14a442cd931290cfcac55e2192a704eff63562
SHA512

bb05373ab0eff4ec160aae10433a80ce9ee176ec9f55063f96d1bca73ae14429bd19960e8fc9d520ae144f2ec6f6ec7c9b95b8e185c228c1415c379bc4db0196
SSDEEP

3072:vi7VODdV86tS0hqvA7DxTesY6qgN/1IrfZ0eGV0FrQ5mg/zqX5kVyBk3eFx/RiPB:KpOBVHtS0hqvA7Dxa9pgN/2rO4n6Q+

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

rc4.i32

Extracted

Family

redline

Botnet

LogsDiller Cloud (Bot: @logsdillabot)

C2

194.49.94.181:40264

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes

install_dir
cd1f156d67
install_file
Utsysc.exe
strings_key
0dd3e5ee91b367c60c9e575983554b30
url_paths
/ghsdh39s/index.php

rc4.plain

Targets

- Target
  
  c08eee0129f5e63f5226ff413a14a442cd931290cfcac55e2192a704eff63562
- Size
  
  288KB
- MD5
  
  0e609e4681b1b5244aed42409f22d19c
- SHA1
  
  9b0627a36900165af87270a52c6eb07d30e9fa43
- SHA256
  
  c08eee0129f5e63f5226ff413a14a442cd931290cfcac55e2192a704eff63562
- SHA512
  
  bb05373ab0eff4ec160aae10433a80ce9ee176ec9f55063f96d1bca73ae14429bd19960e8fc9d520ae144f2ec6f6ec7c9b95b8e185c228c1415c379bc4db0196
- SSDEEP
  
  3072:vi7VODdV86tS0hqvA7DxTesY6qgN/1IrfZ0eGV0FrQ5mg/zqX5kVyBk3eFx/RiPB:KpOBVHtS0hqvA7Dxa9pgN/2rO4n6Q+
Score

10^/10

amadey redline smokeloader logsdiller cloud (bot: @logsdillabot)backdoor evasion infostealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1