amadey

Resubmissions

30-01-2024 18:55

240130-xk9t8aahc9 10

30-01-2024 18:49

240130-xgtzlacbek 10

30-01-2024 17:26

240130-vzvbzabegr 10

Sharing

Copy URL

Twitter E-mail

General

Target

fe5aa71a9083e8e8afe13394c10f01df.exe
Size

790KB
Sample

240130-xk9t8aahc9
MD5

fe5aa71a9083e8e8afe13394c10f01df
SHA1

62111b0428acfc13dd5f8d6b23c14c56f7c20e06
SHA256

f85208dafa53821b234f115339f4c2dfd60a59bf51e3b60753e8790df688e19e
SHA512

6de7fef22f295e8d4548c4c60da98f129e8ad4e0d761dc5ba15c74fb18f8ffe9e5f3b9487a26917dc9e8d81d78a2bc17722781adb7b81e20ed1f0c1ee3de6617
SSDEEP

12288:QcjlmwpPa5yDBonlo7YNQGGnBaWn1sPDqWOF4GoBMePb0lvznThMlDWH2h:QomwpPa55nmwQjBaWn1CqAXBMDHhMt

Malware Config

Extracted

Family

amadey

Version

4.15

http://185.215.113.68

Attributes

install_dir
d887ceb89d
install_file
explorhe.exe
strings_key
7cadc181267fafff9df8503e730d60e1
url_paths
/theme/index.php

rc4.plain

Extracted

Family

risepro

65.109.90.47:50500

193.233.132.62:50500

Extracted

Family

redline

Botnet

LiveTraffic

20.79.30.95:33223

Extracted

Family

redline

Botnet

@PixelsCloud

94.156.67.230:13781

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

redline

Botnet

2024

195.20.16.103:20440

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Targets

- Target
  
  fe5aa71a9083e8e8afe13394c10f01df.exe
- Size
  
  790KB
- MD5
  
  fe5aa71a9083e8e8afe13394c10f01df
- SHA1
  
  62111b0428acfc13dd5f8d6b23c14c56f7c20e06
- SHA256
  
  f85208dafa53821b234f115339f4c2dfd60a59bf51e3b60753e8790df688e19e
- SHA512
  
  6de7fef22f295e8d4548c4c60da98f129e8ad4e0d761dc5ba15c74fb18f8ffe9e5f3b9487a26917dc9e8d81d78a2bc17722781adb7b81e20ed1f0c1ee3de6617
- SSDEEP
  
  12288:QcjlmwpPa5yDBonlo7YNQGGnBaWn1sPDqWOF4GoBMePb0lvznThMlDWH2h:QomwpPa55nmwQjBaWn1CqAXBMDHhMt
Score

10^/10

amadey glupteba redline risepro smokeloader stealc xmrig zgrat 2024 @pixelscloud livetraffic pub1 backdoor dropper evasion infostealer loader miner persistence rat stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1