General
-
Target
files.zip
-
Size
8.7MB
-
Sample
240619-ya8pvasgpm
-
MD5
e1308b43d8b85a456dcd491bf5b699bc
-
SHA1
a1721954289dc598b36cc367d9696cd36f2c836d
-
SHA256
dea471b5ef81e7de2db1209136c2d2b483b9c86df632823f61e8d2be08822abc
-
SHA512
2667046052048938ea51b01b47922a53d3641cc01cb000fbc504c6b5825310a147f5f2548622e673285c7a0c994a0c359a66ddfff02c237b41328b4d9143f65b
-
SSDEEP
196608:wbo9EiO5grGiy5qGdenyuig96zBEKOwr4ahuEt4afgFshsdoa+faBe//u:wboeiO51iy5xuz4BEjk4aDyaOsmoaRYO
Malware Config
Extracted
stealc
Extracted
amadey
4.30
ffb1b9
http://proresupdate.com
-
install_dir
4bbb72a446
-
install_file
Hkbsse.exe
-
strings_key
1ebbd218121948a356341fff55521237
-
url_paths
/h9fmdW5/index.php
Targets
-
-
Target
files/Setup.exe
-
Size
202KB
-
MD5
64179e64675e822559cac6652298bdfc
-
SHA1
cceed3b2441146762512918af7bf7f89fb055583
-
SHA256
c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
-
SHA512
ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280
-
SSDEEP
3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect Vidar Stealer
-
Stealc
Stealc is an infostealer written in C++.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-