amadey

Sharing

Copy URL

Twitter E-mail

General

Target

0b9931c8fad7854d92ac734c68f9ab6e0b1df8b7f45b48db2af0d7018d9b976d
Size

1.7MB
Sample

240507-t4njjshc73
MD5

feef06ef21d864d869d18b85c3dedfa1
SHA1

e67cb5fa4ef49e2044197d6a2de4bae5ab1bb52a
SHA256

0b9931c8fad7854d92ac734c68f9ab6e0b1df8b7f45b48db2af0d7018d9b976d
SHA512

b9af55581861db6a8f560f5e0d09764aa3740efe7fc53cef787468a4420ff7a68b3332d93a4b6b8ba0a0a627f429d88d1cc6af7e1f09e0344b4e2594d0c60741
SSDEEP

49152:SKTaBJAskGf6EcwhLD8Y7DeUhDzo1d7uwLpCyG7EreHJ:z3ZEcw0SzDYjLiOy

Malware Config

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

redline

Botnet

Test1234

185.215.113.67:26260

Extracted

Family

stealc

http://52.143.157.84

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Extracted

Family

redline

Botnet

newpub

185.215.113.67:26260

Extracted

Family

lumma

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Targets

- Target
  
  0b9931c8fad7854d92ac734c68f9ab6e0b1df8b7f45b48db2af0d7018d9b976d
- Size
  
  1.7MB
- MD5
  
  feef06ef21d864d869d18b85c3dedfa1
- SHA1
  
  e67cb5fa4ef49e2044197d6a2de4bae5ab1bb52a
- SHA256
  
  0b9931c8fad7854d92ac734c68f9ab6e0b1df8b7f45b48db2af0d7018d9b976d
- SHA512
  
  b9af55581861db6a8f560f5e0d09764aa3740efe7fc53cef787468a4420ff7a68b3332d93a4b6b8ba0a0a627f429d88d1cc6af7e1f09e0344b4e2594d0c60741
- SSDEEP
  
  49152:SKTaBJAskGf6EcwhLD8Y7DeUhDzo1d7uwLpCyG7EreHJ:z3ZEcw0SzDYjLiOy
Score

10^/10

amadey lumma privateloader redline risepro stealc zgrat @cloudytteam newpub test1234 discovery evasion execution infostealer loader persistence rat spyware stealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2