amadey

General

Target

987123.exe
Size

288KB
Sample

240302-1wk7sahg7y
MD5

f33ee068a842d9f05958d94bfe854898
SHA1

148e00b29d757e6f7569a9611fef4ecebc5b0ebf
SHA256

80bf6ec459fae7ecaff490640d7f44f4099d1c009dce7ae60b831eff3f046204
SHA512

49d49a145eadad5bb69c3fb0118ee892621e7cd9a636a194b17f05ee9fca995109989a428d9b10933b8e9a6287868b8a26d8d1c43b59045b8e4076223d9198bf
SSDEEP

6144:SvFJmC64J/oBO7j3VXlbBbQOg/8BDfUsT:SvFJmETv9l1Og

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes

strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.218.68.91:7690

Targets

- Target
  
  987123.exe
- Size
  
  288KB
- MD5
  
  f33ee068a842d9f05958d94bfe854898
- SHA1
  
  148e00b29d757e6f7569a9611fef4ecebc5b0ebf
- SHA256
  
  80bf6ec459fae7ecaff490640d7f44f4099d1c009dce7ae60b831eff3f046204
- SHA512
  
  49d49a145eadad5bb69c3fb0118ee892621e7cd9a636a194b17f05ee9fca995109989a428d9b10933b8e9a6287868b8a26d8d1c43b59045b8e4076223d9198bf
- SSDEEP
  
  6144:SvFJmC64J/oBO7j3VXlbBbQOg/8BDfUsT:SvFJmETv9l1Og
Score

10^/10

amadey glupteba redline smokeloader zgrat livetraffic pub1 backdoor dave dropper evasion infostealer loader rat trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Dave packer
  Detects executable using a packer named 'Dave' by the community, based on a string at the end.
  dave
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1