General

  • Target

    27412bfa8473437f581467f97e9c036ea3002d43d9ace1da2d03fad36f8696a6

  • Size

    1.8MB

  • Sample

    240512-m33thsca6t

  • MD5

    545022a5328690bd304d2c923724c73e

  • SHA1

    11d5ea5992e45fdb6fd794be6961ec6b6c72729c

  • SHA256

    27412bfa8473437f581467f97e9c036ea3002d43d9ace1da2d03fad36f8696a6

  • SHA512

    9d3f776b8f11cb5d61bec41e68988e35af652716217bcfd3fd2406fa7a81bc0cbc9a5f4a8dceb4054ea5cd033648785efbbb7b82c63364568ddf14cee89dc939

  • SSDEEP

    49152:JOMUpSmurF87++ta8Ff+gFCXPBpLz22WG:0RS1r27/k8FGgFmPBp62WG

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://49.13.229.86

http://185.172.128.150

Attributes
  • url_path

    /c73eed764cc59dcb.php

Targets

    • Target

      27412bfa8473437f581467f97e9c036ea3002d43d9ace1da2d03fad36f8696a6

    • Size

      1.8MB

    • MD5

      545022a5328690bd304d2c923724c73e

    • SHA1

      11d5ea5992e45fdb6fd794be6961ec6b6c72729c

    • SHA256

      27412bfa8473437f581467f97e9c036ea3002d43d9ace1da2d03fad36f8696a6

    • SHA512

      9d3f776b8f11cb5d61bec41e68988e35af652716217bcfd3fd2406fa7a81bc0cbc9a5f4a8dceb4054ea5cd033648785efbbb7b82c63364568ddf14cee89dc939

    • SSDEEP

      49152:JOMUpSmurF87++ta8Ff+gFCXPBpLz22WG:0RS1r27/k8FGgFmPBp62WG

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies firewall policy service

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Stealc

      Stealc is an infostealer written in C++.

    • XMRig Miner payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.