General

  • Target

    4cda51f486155a27f162eb755d98e73b2213adb2ef36f7cbe059577b77d6037c.exe

  • Size

    1.8MB

  • Sample

    240824-bks1tazbkr

  • MD5

    8f6277714414031d47e28f0b4137b71e

  • SHA1

    b0b1753d54b7d204c60e1a58856d02317b11be76

  • SHA256

    4cda51f486155a27f162eb755d98e73b2213adb2ef36f7cbe059577b77d6037c

  • SHA512

    0f44dcf6bb10ef2796f8b777305fc1cfc1e9a4b8065564949496d7c5648baf73f5b42eeae0ded302220492baf965142461b1fc40d84099c0814fcd4c3f6f0922

  • SSDEEP

    49152:HoWJR9y8CyNAKol0TDLmKQVHM/8kl2nf1rI6:IWJLzzij0TDZmHQu

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.163.21:29257

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

14082024

C2

185.215.113.67:21405

Extracted

Family

redline

Botnet

816FA

C2

88.99.151.68:7200

Extracted

Family

lumma

C2

https://potentioallykeos.shop/api

https://deicedosmzj.shop/api

Extracted

Family

amadey

Version

4.41

Botnet

a51500

C2

http://api.garageserviceoperation.com

Attributes
  • install_dir

    0cf505a27f

  • install_file

    ednfovi.exe

  • strings_key

    0044a8b8e295529eaf3743c9bc3171d2

  • url_paths

    /CoreOPT/index.php

rc4.plain
1
c1ec479e5342a25940592acf24703eb2

Extracted

Family

xworm

C2

154.216.18.213:7000

Attributes
  • install_file

    USB.exe

Targets

    • Target

      4cda51f486155a27f162eb755d98e73b2213adb2ef36f7cbe059577b77d6037c.exe

    • Size

      1.8MB

    • MD5

      8f6277714414031d47e28f0b4137b71e

    • SHA1

      b0b1753d54b7d204c60e1a58856d02317b11be76

    • SHA256

      4cda51f486155a27f162eb755d98e73b2213adb2ef36f7cbe059577b77d6037c

    • SHA512

      0f44dcf6bb10ef2796f8b777305fc1cfc1e9a4b8065564949496d7c5648baf73f5b42eeae0ded302220492baf965142461b1fc40d84099c0814fcd4c3f6f0922

    • SSDEEP

      49152:HoWJR9y8CyNAKol0TDLmKQVHM/8kl2nf1rI6:IWJLzzij0TDZmHQu

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Xworm Payload

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Stealc

      Stealc is an infostealer written in C++.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.