amadey

General

Target

NEAS.fe6064e70c302549004b15d0f89c94776ab0e1ce0c8b6be604e52f4d7beac73dexe.exe
Size

6.8MB
Sample

231204-t26bkscg61
MD5

ddf2aea0506931c450cf907bf002e9e0
SHA1

1eb6a7713b2956bad228a2d22b82b28578741c35
SHA256

fe6064e70c302549004b15d0f89c94776ab0e1ce0c8b6be604e52f4d7beac73d
SHA512

3f948981838f6380bfb2ccf6fe5400928bfa2867b6d86c78b7d8d22c5cd028aa8115415b4a9e1e7fd0d932bb2ae776c3e9c6d212fbfffea0e1ca1ec4bb93c2a8
SSDEEP

196608:RWBi7WP9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKDO:ROsWPkYVI5DK2NNs6LtYdEhSp

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes

install_dir
cd1f156d67
install_file
Utsysc.exe
strings_key
0dd3e5ee91b367c60c9e575983554b30
url_paths
/ghsdh39s/index.php

rc4.plain

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Targets

- Target
  
  NEAS.fe6064e70c302549004b15d0f89c94776ab0e1ce0c8b6be604e52f4d7beac73dexe.exe
- Size
  
  6.8MB
- MD5
  
  ddf2aea0506931c450cf907bf002e9e0
- SHA1
  
  1eb6a7713b2956bad228a2d22b82b28578741c35
- SHA256
  
  fe6064e70c302549004b15d0f89c94776ab0e1ce0c8b6be604e52f4d7beac73d
- SHA512
  
  3f948981838f6380bfb2ccf6fe5400928bfa2867b6d86c78b7d8d22c5cd028aa8115415b4a9e1e7fd0d932bb2ae776c3e9c6d212fbfffea0e1ca1ec4bb93c2a8
- SSDEEP
  
  196608:RWBi7WP9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKDO:ROsWPkYVI5DK2NNs6LtYdEhSp
Score

10^/10

amadey evasion themida trojan glupteba smokeloader up3 backdoor discovery dropper loader persistence upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2