amadey

Sharing

Copy URL

Twitter E-mail

General

Target

7d1ba7070a1261c5bd8eb7f36b94459d9f0351ee0b8436e6c1b7f9680251d7e4.exe
Size

1.8MB
Sample

240507-v71tqage7w
MD5

7f403a8f08d295f3bcb884904967ca09
SHA1

a08ba114fc0b0b8f766a979f3a61e033e62a3b46
SHA256

7d1ba7070a1261c5bd8eb7f36b94459d9f0351ee0b8436e6c1b7f9680251d7e4
SHA512

8ee20adb8edbc14c053b88aed767e6b6fb46b5907c211257c6e9ea3f2249108f70245d4b01d95610bb9015a58775e2f2785bb0648add522fd8eb1bb6c40f14d3
SSDEEP

49152:TxJH07bcuwSYqKBU1+GrsqWp/kz9pdAaDP+:dPuwSYqKBU16qSkz9pdAM2

Malware Config

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

185.215.113.67:26260

Extracted

Family

redline

Botnet

newpub

185.215.113.67:26260

Targets

- Target
  
  7d1ba7070a1261c5bd8eb7f36b94459d9f0351ee0b8436e6c1b7f9680251d7e4.exe
- Size
  
  1.8MB
- MD5
  
  7f403a8f08d295f3bcb884904967ca09
- SHA1
  
  a08ba114fc0b0b8f766a979f3a61e033e62a3b46
- SHA256
  
  7d1ba7070a1261c5bd8eb7f36b94459d9f0351ee0b8436e6c1b7f9680251d7e4
- SHA512
  
  8ee20adb8edbc14c053b88aed767e6b6fb46b5907c211257c6e9ea3f2249108f70245d4b01d95610bb9015a58775e2f2785bb0648add522fd8eb1bb6c40f14d3
- SSDEEP
  
  49152:TxJH07bcuwSYqKBU1+GrsqWp/kz9pdAaDP+:dPuwSYqKBU16qSkz9pdAM2
Score

10^/10

amadey glupteba privateloader redline risepro zgrat newpub test1234 discovery dropper evasion execution infostealer loader persistence rat spyware stealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Modifies boot configuration data using bcdedit
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2