General

  • Target

    1790b57cfe11d52a447cb53b7632e0d9.bin

  • Size

    1.8MB

  • Sample

    241223-bcyw4atjhm

  • MD5

    1c07ff98cbdae78751d277a49cc3c966

  • SHA1

    8380869a9c37069a184254cadc0f69fe84f098fc

  • SHA256

    81f13f2861dcdcf514bdda56ef8ef4865e131ce2aec71cff4ae54c7263846690

  • SHA512

    622b0d009c0ad36d6a09a4569039e34acf4c6e16d3092e6e2d81aea4ba357091ac0a778b7b989c653d4306659474a34b500cffe313e14abbc56bd8a23eb6b8c0

  • SSDEEP

    49152:1xWv6bkTbiXAmjUC9VK8+oIpWgqxG+bGKuO5sI:3WbaXVjhvKLIdGKuO5r

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://pollution-raker.cyou/api

https://hosue-billowy.cyou/api

https://ripe-blade.cyou/api

https://smash-boiling.cyou/api

https://supporse-comment.cyou/api

https://greywe-snotty.cyou/api

https://steppriflej.xyz/api

https://sendypaster.xyz/api

Extracted

Family

cryptbot

Targets

    • Target

      09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe

    • Size

      3.1MB

    • MD5

      1790b57cfe11d52a447cb53b7632e0d9

    • SHA1

      3e4eb8d73efbe3ba55fbb61c8a0cfda695e302ef

    • SHA256

      09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761

    • SHA512

      a313ee1313aa77c1174af8a753eb82e23380247d1f915a1c6615bb553306732cbd30717ec37bf755c7e40520623ec4d81bb67942fd6a9f310568d0385b4996dd

    • SSDEEP

      49152:AC5ecDgoqWFmKbjvQk5Nr2eXR7UaLqxHND9KqaC:BecDg3WFmKbjvQk5F2khUYq1J9Kqa

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies Windows Defender Real-time Protection settings

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Enumerates processes with tasklist

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks