amadey

Sharing

Copy URL

Twitter E-mail

General

Target

bf3e907ed150c7a8c1046c550d09f9e6309db73ea4d2c7e5c83da928d0a19b54
Size

1.8MB
Sample

240602-cmfc6sfd3s
MD5

1df5d38d44d6821ba587a399daf9eb83
SHA1

6023e2791fb481828b320edfe8bb8a62075d9eb7
SHA256

bf3e907ed150c7a8c1046c550d09f9e6309db73ea4d2c7e5c83da928d0a19b54
SHA512

6f2094a2c19410d413bb424b78853395fee83154d281484cc46e317cdc9e8f41618d99fe1fa5ce0e0421b3ad270c3e30c56b8b1c831f365350ac6562147c4ced
SSDEEP

49152:XE31IJLLI3BtM9dH8IhswdVA6VSwS/eQwKovE:MIW3M9dH8CswdvVSwS4

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://94.103.188.126/jerry/putty.zip

Extracted

Family

amadey

Version

4.21

Botnet

49e482

http://147.45.47.70

Attributes

install_dir
1b29d73536
install_file
axplont.exe
strings_key
4d31dd1a190d9879c21fac6d87dc0043
url_paths
/tr8nomy/index.php

rc4.plain

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Fresh

pepecasas123.net:4608

Mutex

AsyncMutex_5952

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

smokeloader

Version

2022

http://dbfhns.in/tmp/index.php

http://guteyr.cc/tmp/index.php

http://greendag.ru/tmp/index.php

http://lobulraualov.in.net/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  bf3e907ed150c7a8c1046c550d09f9e6309db73ea4d2c7e5c83da928d0a19b54
- Size
  
  1.8MB
- MD5
  
  1df5d38d44d6821ba587a399daf9eb83
- SHA1
  
  6023e2791fb481828b320edfe8bb8a62075d9eb7
- SHA256
  
  bf3e907ed150c7a8c1046c550d09f9e6309db73ea4d2c7e5c83da928d0a19b54
- SHA512
  
  6f2094a2c19410d413bb424b78853395fee83154d281484cc46e317cdc9e8f41618d99fe1fa5ce0e0421b3ad270c3e30c56b8b1c831f365350ac6562147c4ced
- SSDEEP
  
  49152:XE31IJLLI3BtM9dH8IhswdVA6VSwS/eQwKovE:MIW3M9dH8CswdvVSwS4
Score

10^/10

amadey asyncrat dcrat privateloader smokeloader 49e482 fresh adware backdoor bootkit discovery evasion execution infostealer loader persistence rat spyware stealer trojan pub1
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox system UUIDs
- Detects executables packed with or use KoiVM
- Detects executables referencing many IR and analysis tools
- Detects file containing reversed ASEP Autorun registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2