Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Resubmissions

16/02/2024, 05:11

240216-fvbxhaac5s10

16/02/2024, 04:50

240216-ff8ypaae6610

Sharing

Copy URL Twitter E-mail

General

  • Target
    c41b3fb6b30753a23f0b274f4f176202915d248256140e4512d541589b62bdc9
  • Size 236KB
  • Sample240216-ff8ypaae66
  • SHA256 c41b3fb6b30753a23f0b274f4f176202915d248256140e4512d541589b62bdc9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeysmokeloaderpub3backdoorspywarestealertrojan

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • pub3

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://sjyey.com/tmp/index.php

  • http://babonwo.ru/tmp/index.php

  • http://mth.com.ua/tmp/index.php

  • http://piratia.pw/tmp/index.php

  • http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32

Extracted

Family

  • amadey

Version

  • 4.14

C2

  • http://anfesq.com

  • http://cbinr.com

  • http://rimakc.ru

Attributes
  • install_dir

    68fd3d7ade

  • install_file

    Utsysc.exe

  • strings_key

    27ec7fd6f50f63b8af0c1d3deefcc8fe

  • url_paths

    /forum/index.php

rc4.plain

Targets

    • Target
      c41b3fb6b30753a23f0b274f4f176202915d248256140e4512d541589b62bdc9
    • Size 236KB
    • SHA256 c41b3fb6b30753a23f0b274f4f176202915d248256140e4512d541589b62bdc9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    amadeysmokeloaderpub3backdoorspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks