amadey

Sharing

General

Target

d2c30accc7bc148478b4881e453f826a3ddf71e0684434dddcd2f4e28e1c1aba
Size

1.8MB
Sample

240508-mmpxqaaf76
MD5

8f9f0e11be92a88b43c5d34ef03b7c66
SHA1

5185eaa83c1b6f9fdc2ba846fa3585aa19ecc703
SHA256

d2c30accc7bc148478b4881e453f826a3ddf71e0684434dddcd2f4e28e1c1aba
SHA512

69be85b6b1ad5444a036a5cd4cc91d511156a89a6a939b929f8d113350c12b1a2a45cccc377a088e1fb896240d13a58cf8d661e713103282e1e61b3cb491f39a
SSDEEP

49152:jZo4Yu5omRbaRcLspn1trKtoRdUoSYfWF+Q7:jZUuqmR+pTtrKgdRM

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

185.215.113.67:26260

Extracted

Family

stealc

http://49.13.229.86

http://185.172.128.150

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Targets

- Target
  
  d2c30accc7bc148478b4881e453f826a3ddf71e0684434dddcd2f4e28e1c1aba
- Size
  
  1.8MB
- MD5
  
  8f9f0e11be92a88b43c5d34ef03b7c66
- SHA1
  
  5185eaa83c1b6f9fdc2ba846fa3585aa19ecc703
- SHA256
  
  d2c30accc7bc148478b4881e453f826a3ddf71e0684434dddcd2f4e28e1c1aba
- SHA512
  
  69be85b6b1ad5444a036a5cd4cc91d511156a89a6a939b929f8d113350c12b1a2a45cccc377a088e1fb896240d13a58cf8d661e713103282e1e61b3cb491f39a
- SSDEEP
  
  49152:jZo4Yu5omRbaRcLspn1trKtoRdUoSYfWF+Q7:jZUuqmR+pTtrKgdRM
Score

10^/10

amadey evasion execution spyware stealer trojan glupteba privateloader redline stealc zgrat @cloudytteam test1234 discovery dropper infostealer loader rat themida
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2