General

  • Target

    file.exe

  • Size

    6.4MB

  • Sample

    231221-ygys8aebe3

  • MD5

    0607a527a8ef15720f3bee3a134d3e76

  • SHA1

    9777a7ffac5e18b9b8b9a566a1be17f0ab1ab402

  • SHA256

    236b141121d5f8772f85bf485a6675102c871e22734bcb8f2e11478c2d8d3365

  • SHA512

    e23c17e0cee9aeff608712f5b919f7862bec9c4391de4dd7efc84e16f58497728a564bec9444be7f68d60d58b19ca0b40983485bdc15a57d273fc043729a5813

  • SSDEEP

    196608:l1cMrm+eLFVlfqATlzu6TJDFqODrncCIexHIKfU:lzsLFVlxi6TZcOVIcZ

Malware Config

Extracted

Family

amadey

Version

4.13

C2

http://185.172.128.5

Attributes
  • install_dir

    4fdb51ccdc

  • install_file

    Utsysc.exe

  • strings_key

    11bb398ff31ee80d2c37571aecd1d36d

  • url_paths

    /v8sjh3hs8/index.php

rc4.plain

Extracted

Family

amadey

C2

http://185.172.128.5

Attributes
  • strings_key

    11bb398ff31ee80d2c37571aecd1d36d

  • url_paths

    /v8sjh3hs8/index.php

rc4.plain

Targets

    • Target

      file.exe

    • Size

      6.4MB

    • MD5

      0607a527a8ef15720f3bee3a134d3e76

    • SHA1

      9777a7ffac5e18b9b8b9a566a1be17f0ab1ab402

    • SHA256

      236b141121d5f8772f85bf485a6675102c871e22734bcb8f2e11478c2d8d3365

    • SHA512

      e23c17e0cee9aeff608712f5b919f7862bec9c4391de4dd7efc84e16f58497728a564bec9444be7f68d60d58b19ca0b40983485bdc15a57d273fc043729a5813

    • SSDEEP

      196608:l1cMrm+eLFVlfqATlzu6TJDFqODrncCIexHIKfU:lzsLFVlxi6TZcOVIcZ

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Uses the VBS compiler for execution

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks