amadey

General

Target

60fd1407d5c89dc95514e8aa53eeb3ff74df0abd3501892606201f8e576862fb
Size

289KB
Sample

231126-dpwzdaeh2v
MD5

0694527fa155e9e87e79bd6d21a4904a
SHA1

423461ac150afc225e233ad53746413dd14813a2
SHA256

60fd1407d5c89dc95514e8aa53eeb3ff74df0abd3501892606201f8e576862fb
SHA512

2aa959ae406bf8a67d3fc369d9703fb3a09c709417e62b70c62357959012ad524314578f35830f718e2de9fc3a345f5fe2b599b0e43f042803483217b38a5db2
SSDEEP

3072:ElRBOdYEWKcVmTefZcOe7+qhhmD8fML8DfcaXQ5mgRxFU5kVyBk3eFx/RiPB:YfOSEWKcQTefZSRhvncyYxFA+

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

rc4.i32

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes

install_dir
cd1f156d67
install_file
Utsysc.exe
strings_key
0dd3e5ee91b367c60c9e575983554b30
url_paths
/ghsdh39s/index.php

rc4.plain

Extracted

Family

redline

Botnet

LogsDiller Cloud (Bot: @logsdillabot)

C2

194.49.94.181:40264

Targets

- Target
  
  60fd1407d5c89dc95514e8aa53eeb3ff74df0abd3501892606201f8e576862fb
- Size
  
  289KB
- MD5
  
  0694527fa155e9e87e79bd6d21a4904a
- SHA1
  
  423461ac150afc225e233ad53746413dd14813a2
- SHA256
  
  60fd1407d5c89dc95514e8aa53eeb3ff74df0abd3501892606201f8e576862fb
- SHA512
  
  2aa959ae406bf8a67d3fc369d9703fb3a09c709417e62b70c62357959012ad524314578f35830f718e2de9fc3a345f5fe2b599b0e43f042803483217b38a5db2
- SSDEEP
  
  3072:ElRBOdYEWKcVmTefZcOe7+qhhmD8fML8DfcaXQ5mgRxFU5kVyBk3eFx/RiPB:YfOSEWKcQTefZSRhvncyYxFA+
Score

10^/10

amadey redline smokeloader logsdiller cloud (bot: @logsdillabot)backdoor evasion infostealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1