General

  • Target

    2025-04-05_3a7a07298c22363a144ebeca63545efe_agent-tesla_black-basta_cobalt-strike_luca-stealer

  • Size

    938KB

  • Sample

    250405-chjvsszry3

  • MD5

    3a7a07298c22363a144ebeca63545efe

  • SHA1

    7c20930cd69c339151398444de355de1fb1e13ca

  • SHA256

    6554fa82ba24090b93676f6fb0d64692f97f63d064c7676963b084b9967cb1c1

  • SHA512

    376db910bcd13ab9f8921f131ae55ec2608888fd5afdae266fe89a29725d70c5e0281e0425f9527776277ca80fc0c95111200a4c88723b0d030f2f7074294060

  • SSDEEP

    24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8a0ou:yTvC/MTQYxsWR7a0o

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Extracted

Family

lumma

C2

https://pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://spuerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://padvennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://kywmedici.top/noagis

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://advennture.top/GKsiio

https://xrfxcaseq.live/gspaz

https://ywmedici.top/noagis

https://6grxeasyw.digital/xxepw

https://gkrxspint.digital/kendwz

https://erhxhube.run/pogrs

Targets

    • Target

      2025-04-05_3a7a07298c22363a144ebeca63545efe_agent-tesla_black-basta_cobalt-strike_luca-stealer

    • Size

      938KB

    • MD5

      3a7a07298c22363a144ebeca63545efe

    • SHA1

      7c20930cd69c339151398444de355de1fb1e13ca

    • SHA256

      6554fa82ba24090b93676f6fb0d64692f97f63d064c7676963b084b9967cb1c1

    • SHA512

      376db910bcd13ab9f8921f131ae55ec2608888fd5afdae266fe89a29725d70c5e0281e0425f9527776277ca80fc0c95111200a4c88723b0d030f2f7074294060

    • SSDEEP

      24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8a0ou:yTvC/MTQYxsWR7a0o

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Detects MeshAgent payload

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

    • Meshagent family

    • Modifies Windows Defender DisableAntiSpyware settings

    • Modifies Windows Defender Real-time Protection settings

    • Modifies Windows Defender TamperProtection settings

    • Modifies Windows Defender notification settings

    • Modifies security service

    • Contacts a large (4600) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

    • Stops running service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Modifies file permissions

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Enumerates processes with tasklist

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks