General

  • Target

    95eb3c7a36ea30b9a86fc19e958a49b472d3b6224ee3c5581bfd9a6669b02bfd.exe

  • Size

    3.7MB

  • Sample

    241206-amck6swlgm

  • MD5

    47d78937897b4346b6ad5e5501d8b864

  • SHA1

    687a26e05cf5151da22f4ab9713ecad7e447c795

  • SHA256

    95eb3c7a36ea30b9a86fc19e958a49b472d3b6224ee3c5581bfd9a6669b02bfd

  • SHA512

    17bc5ac8b9a2b723706f7c29b48ebbfab28e57b432298fc1ae08dcf9219f6d3d8ced70a5b310dedfadbeba408fba7e0a4629491a0b5649d4f9ae2406070ab0b0

  • SSDEEP

    98304:0fEs/7VYZPG7/wGd8BIxAhStyekHscn8BdXj9tv+pT:095GGdshStyekH5nUdXjPmp

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

xworm

C2

185.196.8.239:7000

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    WindowsUpdaterConf.exe

  • telegram

    https://api.telegram.org/bot8070077125:AAEdRIyp1anHye9Y0jcV8uNF6U4mmijN8Pk/sendMessage?chat_id=1818813749

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://dare-curbys.biz/api

https://print-vexer.biz/api

Targets

    • Target

      95eb3c7a36ea30b9a86fc19e958a49b472d3b6224ee3c5581bfd9a6669b02bfd.exe

    • Size

      3.7MB

    • MD5

      47d78937897b4346b6ad5e5501d8b864

    • SHA1

      687a26e05cf5151da22f4ab9713ecad7e447c795

    • SHA256

      95eb3c7a36ea30b9a86fc19e958a49b472d3b6224ee3c5581bfd9a6669b02bfd

    • SHA512

      17bc5ac8b9a2b723706f7c29b48ebbfab28e57b432298fc1ae08dcf9219f6d3d8ced70a5b310dedfadbeba408fba7e0a4629491a0b5649d4f9ae2406070ab0b0

    • SSDEEP

      98304:0fEs/7VYZPG7/wGd8BIxAhStyekHscn8BdXj9tv+pT:095GGdshStyekH5nUdXjPmp

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detect Xworm Payload

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies Windows Defender Real-time Protection settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Windows security modification

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.