amadey

Sharing

General

Target

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab
Size

1.9MB
Sample

240904-wxaefsvarj
MD5

26cdd93ab5aa02332cd33c0282beba9f
SHA1

dbe088a6a212f0bb38b01a4ba7e1b4d1e2d06438
SHA256

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab
SHA512

a8e45e60e2a4ad0ed0b8f7462f5a6abe3a7ab8a58be9762acb849adc16d09af47b7206aa4d096192a673c3e570d45c2d55853b1453b114102d51b7b753382955
SSDEEP

49152:6wsNTwnR1z6iK3VQfFMkn3mCz5wIuicZ:6w6ToDgiMknWw1

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

cryptbot

analforeverlovyu.top

fivev5vt.top

sevxv17pn.top

Attributes

url_path
/v1/upload.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Targets

- Target
  
  de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab
- Size
  
  1.9MB
- MD5
  
  26cdd93ab5aa02332cd33c0282beba9f
- SHA1
  
  dbe088a6a212f0bb38b01a4ba7e1b4d1e2d06438
- SHA256
  
  de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab
- SHA512
  
  a8e45e60e2a4ad0ed0b8f7462f5a6abe3a7ab8a58be9762acb849adc16d09af47b7206aa4d096192a673c3e570d45c2d55853b1453b114102d51b7b753382955
- SSDEEP
  
  49152:6wsNTwnR1z6iK3VQfFMkn3mCz5wIuicZ:6w6ToDgiMknWw1
Score

10^/10

amadey fed3aa credential_access discovery evasion spyware stealer trojan cryptbot povertystealer redline stealc 1176f2 @cloudytteam default default2 livetraffic infostealer persistence
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- CryptBot
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Detect Poverty Stealer Payload
- Poverty Stealer
  Poverty Stealer is a crypto and infostealer written in C++.
  stealer povertystealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2