amadey

General

Target

files.zip
Size

9.3MB
Sample

240618-xpe6eavcjc
MD5

81b37d006efb1f9fc8c221a5a173049f
SHA1

e92f7eab8e95d924f0c52df001d53c445312e201
SHA256

6a136a7426b8770d8664cc9e508c093bf597231738e853f21e597dac99534bf3
SHA512

8f115e8e38be8077587e3921430f42276ad0b3139472902d0513794f5a24511e2097669007884225f9188c42a8101fb494fe75ac5c65247fd04d5f3207d4407a
SSDEEP

196608:gV/X+YkIz22nAyx0EZ52yebghAr0QSK8/ozq4qWD65SD74PyUaBe//P:wmt27/L5errDSKTzIk74q5Yv

Score

10^/10

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

amadey

Version

4.30

Botnet

ffb1b9

C2

http://proresupdate.com

Attributes

install_dir
4bbb72a446
install_file
Hkbsse.exe
strings_key
1ebbd218121948a356341fff55521237
url_paths
/h9fmdW5/index.php

rc4.plain

Targets

- Target
  
  files/Setup.exe
- Size
  
  5.5MB
- MD5
  
  9d8649afd4141d960b6545998fbc423b
- SHA1
  
  3ddd700caaebab0a9d2ed640f235d4b716a505de
- SHA256
  
  db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
- SHA512
  
  0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
- SSDEEP
  
  49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
Score

10^/10

stealc vidar stealer amadey xmrig ffb1b9 discovery miner spyware trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Vidar Stealer
  stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3