Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Resubmissions

13/02/2024, 00:43

240213-a2wycsgh5710

12/02/2024, 04:50

240212-fgplfadc7310

Sharing

Copy URL Twitter E-mail

General

  • Target
    2867629034ad3756930e22f7c88160253e84db1925821f1b214848feee03db10
  • Size 225KB
  • Sample240212-fgplfadc73
  • SHA256 2867629034ad3756930e22f7c88160253e84db1925821f1b214848feee03db10
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeysmokeloaderpub3backdoorspywarestealertrojan

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • pub3

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://sjyey.com/tmp/index.php

  • http://babonwo.ru/tmp/index.php

  • http://mth.com.ua/tmp/index.php

  • http://piratia.pw/tmp/index.php

  • http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32

Extracted

Family

  • amadey

Version

  • 4.14

C2

  • http://anfesq.com

  • http://cbinr.com

  • http://rimakc.ru

Attributes
  • install_dir

    68fd3d7ade

  • install_file

    Utsysc.exe

  • strings_key

    27ec7fd6f50f63b8af0c1d3deefcc8fe

  • url_paths

    /forum/index.php

rc4.plain

Targets

    • Target
      2867629034ad3756930e22f7c88160253e84db1925821f1b214848feee03db10
    • Size 225KB
    • SHA256 2867629034ad3756930e22f7c88160253e84db1925821f1b214848feee03db10
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    amadeysmokeloaderpub3backdoorspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks