amadey

Sharing

Copy URL

Twitter E-mail

General

Target

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466
Size

1.8MB
Sample

240620-2ezvaazgmc
MD5

53280503a04c035e6ba9164bb99009db
SHA1

da55dba7cc2132b2316e4b0667c7767d3730d858
SHA256

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466
SHA512

2ea1d54f414f80eb31654000b830a5255b392f164e7d90fa5fde11c944bf8117e84559628c2c3d7a291566af3a037465c2d8d77199713b8d5e018962fc7b8559
SSDEEP

49152:6zklgf2ET665Bqd97jryccdZw8PzVuDYyDimqYb:qHhT665Ad970di8cDi

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.qit.ne.jp
Port:
587
Username:
[email protected]
Password:
manymany

Extracted

Credentials

Protocol: smtp
Host:
smtp.nuovarele.it
Port:
587
Username:
[email protected]
Password:
Vv891971

Extracted

Credentials

Protocol: smtp
Host:
smtp.ak.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
gundam

Extracted

Credentials

Protocol: smtp
Host:
smtp.ar.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
itty081101

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
LcQb0UKvG5ZpdOhwlzO.2

Extracted

Credentials

Protocol: smtp
Host:
smtp.ah.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
jz5w4gbd

Extracted

Credentials

Protocol: smtp
Host:
smtp.ae.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
ns9000

Extracted

Credentials

Protocol: smtp
Host:
smtp.jj.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
t2uma8wn

Extracted

Credentials

Protocol: smtp
Host:
smtp.ce.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
takako0725

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
FaRFAqQpyd9BbQr8SKt.7

Extracted

Credentials

Protocol: smtp
Host:
smtp.ss.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
syunyou1217

Extracted

Credentials

Protocol: smtp
Host:
smtp.frontier.com
Port:
587
Username:
[email protected]
Password:
S12n18m00!@

Extracted

Credentials

Protocol: smtp
Host:
mail.number1cleaningservices.com
Port:
587
Username:
[email protected]
Password:
MeawMeaw2499

Extracted

Credentials

Protocol: smtp
Host:
smtp.af.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
ozawa0623

Extracted

Credentials

Protocol: smtp
Host:
smtp.stdm.net
Port:
587
Username:
[email protected]
Password:
42Quarantadue!

Extracted

Credentials

Protocol: smtp
Host:
smtp.varat.net
Port:
587
Username:
[email protected]
Password:
saracena

Extracted

Credentials

Protocol: smtp
Host:
smtp.nifty.ne.jp
Port:
587
Username:
[email protected]
Password:
REMI2525

Extracted

Credentials

Protocol: smtp
Host:
smtp.ac.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
password

Extracted

Credentials

Protocol: smtp
Host:
mail.cv-net.jp
Port:
587
Username:
[email protected]
Password:
hd883ss

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Extracted

Family

redline

Botnet

LiveTraffic

4.185.27.237:13528

Extracted

Family

lumma

https://parallelmercywksoffw.shop/api

https://liabiliytshareodlkv.shop/api

https://notoriousdcellkw.shop/api

https://conferencefreckewl.shop/api

https://flourhishdiscovrw.shop/api

https://landdumpycolorwskfw.shop/api

https://willingyhollowsk.shop/api

https://barebrilliancedkoso.shop/api

https://distincttangyflippan.shop/api

https://macabrecondfucews.shop/api

https://greentastellesqwm.shop/api

https://stickyyummyskiwffe.shop/api

https://sturdyregularrmsnhw.shop/api

https://lamentablegapingkwaq.shop/api

https://innerverdanytiresw.shop/api

https://standingcomperewhitwo.shop/api

https://accumulationeyerwos.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

Targets

- Target
  
  022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466
- Size
  
  1.8MB
- MD5
  
  53280503a04c035e6ba9164bb99009db
- SHA1
  
  da55dba7cc2132b2316e4b0667c7767d3730d858
- SHA256
  
  022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466
- SHA512
  
  2ea1d54f414f80eb31654000b830a5255b392f164e7d90fa5fde11c944bf8117e84559628c2c3d7a291566af3a037465c2d8d77199713b8d5e018962fc7b8559
- SSDEEP
  
  49152:6zklgf2ET665Bqd97jryccdZw8PzVuDYyDimqYb:qHhT665Ad970di8cDi
Score

10^/10

amadey monster redline risepro 0e6740 e76b71 newbild discovery evasion execution infostealer persistence pyinstaller spyware stealer themida trojan lumma @logscloudyt_bot livetraffic
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Monster Stealer.
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Monster
  Monster is a Golang stealer that was discovered in 2024.
  stealer monster
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Windows security bypass
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2