amadey

Sharing

Copy URL Twitter E-mail

General

Target
inv.zip
Size 12.6MB
Sample240712-pxrv6stfll
SHA256 461cded4b93a8deb76810154e7d6eeb8330fb6e0d7b8e462860b1c4f7f42a138
MD5 7a8ce0d01d8e873dca82ca9c7377c377
SHA1 fffd64b43b3810a7390ac9ceb640d3b3b9ee80a1
SHA512 374c2a435858f283373f977bc8c79f5dedd898d6988045b9e7e80a3f517378c325b921951b65a3c0eec48a5aed3a96c25947d8bfe80966ac31870e5ba7e915dc
SSDEEP 393216:dB66OcY0MyA4HFsyg0EB+4ZI+6jUoGoxUrUIg0EB+40:dY6OAM/ytYtR9KGUItf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

lumma

https://radiationnopp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
https://contemplateodszsv.shop/api
https://applyzxcksdia.shop/api
https://replacedoxcjzp.shop/api
https://declaredczxi.shop/api
https://catchddkxozvp.shop/api
https://arriveoxpzxo.shop/api
https://bindceasdiwozx.shop/api
https://conformfucdioz.shop/api

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199735694209
https://t.me/puffclou

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1

Targets

- Target
  amadka.exe
- Size 1.8MB
- SHA256 bb25aeb8d3150e94b5ace83bc5d2550776d71dff9c78898951faab7a1af751e8
- MD5 8cdbb4f2b779e6d1d1c31144a31deca6
- SHA1 48f9262ed6283c824e52a49f1981318fa7f712ab
- SHA512 1a58b511f69c9fd4f3dc31ed3114aedba8284409600fb2a22daeb8e9110e3e2f040931404e6b5c6b63215e2555085738f837ebbd4783097a3d9aa303c2277144
- SSDEEP 49152:4VjQ5fRdyuULwLakuM6WAKx+1G18+ZpE0/eQM+7PTId9J:UjufR4uULsPVvxjy+ZnQ+L+9J
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3
- Target
  hpproduct.exe
- Size 5.0MB
- SHA256 d1c5dce3d438c76addcfed20a46330ddadbe829fd49452f5728414057b441923
- MD5 63138dfb6f059b316cef364b01ce34e6
- SHA1 5c225a8f99eb3992a0a0ce416648fef02023244d
- SHA512 69a40a3e156ed950458fc6f79fffd42b2ee67a03be616b2874aa3dd1e60ded73a363e8f8d82543b8b0fa00f626439508f799c06a559e3466b589d7e6d3e1fb78
- SSDEEP 98304:WPaFb2DelKDuO4za6WtlXtAJMT1VqHuH3qk8Nfs9H+:fFailK6O418NtAST1eM/8Nfs9H+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

spyware lumma stealc vidar discovery stealer
- Detect Vidar Stealer
  stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral4 behavioral5 behavioral6
- Target
  random.exe
- Size 2.4MB
- SHA256 f085c6c04bb96f24fdbf974025a25ca0baaf01093996d5b8be8f4b03045892c2
- MD5 f320a471da179c2cdb8f920a58d5a49e
- SHA1 c0587747ea1f01591f56df772436487759a56cb3
- SHA512 392f7e1c70ef8445b85d08e554b220b25e228939ecaac90cb55f91a12b826b153cc0ffc0f1a1946a2cca878242080c62a6e64d86cba220deff0012cdd765886e
- SSDEEP 49152:ua+frLou6hg9lGyMJt6ygLSfhJCddlHBf2RwrLfKIlN:efr8hclGS+JkdlHMwnf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8 behavioral9
- Target
  random/random.exe
- Size 1.2MB
- SHA256 749b3f520c92d562330c4f8ce1632933917969d82cdc4fd6293ca2f465d47603
- MD5 65596da80c64cf01a226b19835385b52
- SHA1 4adf4690332eea67d1de16b1eb9196ac4911c93d
- SHA512 ae06264269320aa41216f699bdfb6c0b79f9d030c57372e140ffc6d93a5dfdfd7c41bc0a8e7e4d25823bc9a190e655865f135da049416be2eed912de0dbaed2b
- SSDEEP 24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aLC2Sbly7TWEPje:kTvC/MTQYxsWR7aLC2dW
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral11 behavioral12
- Target
  streamer.exe
- Size 4.7MB
- SHA256 b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2
- MD5 9635389d4492a1bb338d7467cc79a84f
- SHA1 5bf4e06b683c07b6b59da041bc81fdc0e2accf5c
- SHA512 106e536e589a4f76176ea5ecb564f46b6f6d1dda2bf33431fff682a3b2ef8fd4df11b6101118f52e14bb46ea2469697ac5738be07fc97fae28c7ec41dbaa5508
- SSDEEP 49152:ZadqSJa0AzAku0pfKEae72f9tMcf3gBXkjV5Eh/GRJcwq7lSv5TG11kA:IbJa0AFjk5E8a1D
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Suspicious use of SetThreadContext
behavioral13 behavioral14 behavioral15
- Target
  tuman.exe
- Size 2.4MB
- SHA256 f085c6c04bb96f24fdbf974025a25ca0baaf01093996d5b8be8f4b03045892c2
- MD5 f320a471da179c2cdb8f920a58d5a49e
- SHA1 c0587747ea1f01591f56df772436487759a56cb3
- SHA512 392f7e1c70ef8445b85d08e554b220b25e228939ecaac90cb55f91a12b826b153cc0ffc0f1a1946a2cca878242080c62a6e64d86cba220deff0012cdd765886e
- SSDEEP 49152:ua+frLou6hg9lGyMJt6ygLSfhJCddlHBf2RwrLfKIlN:efr8hclGS+JkdlHMwnf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral16 behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Detect Vidar Stealer

Lumma Stealer

Stealc

Vidar

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Amadey

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

Lumma Stealer

Suspicious use of SetThreadContext

Amadey

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10