amadey | 68d80ba2b2662f4491cd7235a27219d405080823f99eb7d7e5149c7bc8943743 | Triage

Sharing

General

Target

3b65813f3d3735aafe026cf0a2993db4e1da3dce321a638c56350fbffdc0c0e9.zip
Size

1.5MB
Sample

240402-mbbwqafa99
MD5

0fbc685adb7350db82b4f96fafce5c59
SHA1

28777bd53fb08c72ab16924937cd497d599b81d6
SHA256

68d80ba2b2662f4491cd7235a27219d405080823f99eb7d7e5149c7bc8943743
SHA512

d8ab1156ff69011cdda79469d8f02bd707bbb04f58f11c6da2845d0c9845d81eb2bf4c7c3d37a9e87c9820891b73704fbd368f948490f4723fe749d8ef47bc2a
SSDEEP

24576:ZKMXEQy97VvhQ75/+exS+IcPbqjLmJ2og4IREWowioU1Dj/TfdWoFay:IJQy9hvYl+WFdTqjqJBZOAwyrJFay

Score

10^/10

amadey mystic redline smokeloader grome backdoor evasion infostealer persistence stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Targets

- Target
  
  3b65813f3d3735aafe026cf0a2993db4e1da3dce321a638c56350fbffdc0c0e9.exe
- Size
  
  1.5MB
- MD5
  
  277a40695913e1f78661c3c75a7616f1
- SHA1
  
  72099b944137f88709780ec3e1f155cc4f45ce91
- SHA256
  
  3b65813f3d3735aafe026cf0a2993db4e1da3dce321a638c56350fbffdc0c0e9
- SHA512
  
  4ac456e3e37fcc1abcd3f41e7b56f6137adcfa3501f6c057b2fb46c77de5dd4e0bc3d54c900b318c8ded3cdf608606a373f2570f6930823daa08a833606b4401
- SSDEEP
  
  49152:3I2qQY9em2fjeFqE6QCPaEbbdWxwzLgaV+1:4T9YaF6QCiEH2e8a4
Score

10^/10

amadey mystic redline smokeloader grome backdoor evasion infostealer persistence stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

amadeymysticredlinesmokeloadergromebackdoorevasioninfostealerpersistencestealertrojanupx