Overview

overview

10

Static

static

10

All.ElectroRAT.zip

windows10-2004-x64

3

All.ElectroRAT.zip

windows11-21h2-x64

1

0468127a19...1f.exe

windows10-2004-x64

3

0468127a19...1f.exe

windows11-21h2-x64

3

2a3b92f618...6b.exe

windows10-2004-x64

10

2a3b92f618...6b.exe

windows11-21h2-x64

10

b154ac015c...cf.exe

windows10-2004-x64

8

b154ac015c...cf.exe

windows11-21h2-x64

8

b96bd6bbf0...69.exe

windows10-2004-x64

10

b96bd6bbf0...69.exe

windows11-21h2-x64

10

bb8e52face...3e.dll

windows10-2004-x64

8

bb8e52face...3e.dll

windows11-21h2-x64

8

ca467e3323...a4.dll

windows10-2004-x64

10

ca467e3323...a4.dll

windows11-21h2-x64

8

e93d6f4ce3...ad.exe

windows10-2004-x64

10

e93d6f4ce3...ad.exe

windows11-21h2-x64

10

fa5390bbcc...f6.exe

windows10-2004-x64

10

fa5390bbcc...f6.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    All.ElectroRAT.zip
  • Size 881KB
  • Sample251130-dedp2sek3x
  • SHA256 dda14413450a11f336a8305cf274943d614905c3429d4f0efeffe6bf4b8b7bdc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeykpot044a28adwarecollectioncredcredential_accessdefense_evasiondiscoveryexecutionmodulepersistencespywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 2.03

Botnet

  • 044a28

Attributes
  • install_dir

    3101f8f780

  • install_file

    gbudn.exe

  • strings_key

    98efc0765f4c223e79368db4c8650353

  • url_paths

    /hfv23svj2/index.php

rc4.plain

Targets

    • Target
      All.ElectroRAT.zip
    • Size 881KB
    • SHA256 dda14413450a11f336a8305cf274943d614905c3429d4f0efeffe6bf4b8b7bdc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    adwarediscoveryspyware
    behavioral1behavioral2
    • Target
      0468127a19daf4c7bc41015c5640fe1f
    • Size 121KB
    • SHA256 dd1792bcdf560ebaa633f72de4037e78fe1ada5c8694b9d4879554aedc323ac9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      2a3b92f6180367306d750e59c9b6446b
    • Size 178KB
    • SHA256 18fd6b193be1d5416a3188f5d9e4047cca719fa067d7d0169cf2df5c7fed54c0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryexecutionamadeypersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Amadey family

      amadey

    • Detects Amadey x86-bit Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral5behavioral6
    • Target
      b154ac015c0d1d6250032f63c749f9cf
    • Size 457KB
    • SHA256 f33c78cddcf99dd999b065644a17dcbac1b222a7f3342b3fe3293ddb6ecf0060
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discovery

    • Modifies RDP port number used by Windows

    behavioral7behavioral8
    • Target
      b96bd6bbf0e3f4f98b606a2ab5db4a69
    • Size 330KB
    • SHA256 2f83e130e52cb13944899e81f4ecf49decf52e3949f6d41b45e8b1a19a658ed6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverykpotspywarestealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Kpot family

      kpot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral9
    • Target
      bb8e52face5b076cc890bbfaaf4bb73e
    • Size 222KB
    • SHA256 5545f31c832c8bde6cf7563cdc0f4a4b9b15416480e14f15420b1691444c376d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discovery

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral11behavioral12
    • Target
      ca467e332368cbae652245faa4978aa4
    • Size 124KB
    • SHA256 279524f17f8dd8753f57c2e3e91d21ad84db10316dfbf925cc19556cef55b99d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    collectioncredcredential_accessdiscoveryamadeymodulespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Amadey family

      amadey

    • Detect Amadey credential stealer module

      credmodule

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral13behavioral14
    • Target
      e93d6f4ce34d4f594d7aed76cfde0fad
    • Size 1024KB
    • SHA256 adeba13b358ea8be691fd7f4d025a6ea27b9b120d97d312ea875d6067434d77e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverykpotspywarestealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Kpot family

      kpot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral15behavioral16
    • Target
      fa5390bbcc4ab768dd81f31eac0950f6
    • Size 598KB
    • SHA256 587a4463673093554cd75b5c9ccb6c254a9d6e8769b1e45ea0390eb2b9d57bff
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverykpotspywarestealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Kpot family

      kpot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral17behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

2
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Remote Services

1
T1021

Remote Desktop Protocol

1
T1021.001

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks

static1

044a28credmoduleamadey
Score
10/10

behavioral1

adwarediscoveryspyware
Score
3/10

behavioral2

Score
1/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discoveryexecutionamadeypersistencetrojan
Score
10/10

behavioral6

discoveryexecutionamadeypersistencetrojan
Score
10/10

behavioral7

discovery
Score
8/10

behavioral8

discovery
Score
8/10

behavioral9

defense_evasiondiscoverykpotspywarestealertrojan
Score
10/10

behavioral10

defense_evasiondiscoverykpotspywarestealertrojan
Score
10/10

behavioral11

discovery
Score
8/10

behavioral12

discovery
Score
8/10

behavioral13

collectioncredcredential_accessdiscoveryamadeymodulespywarestealertrojan
Score
10/10

behavioral14

collectioncredential_accessdiscoveryspywarestealer
Score
8/10

behavioral15

defense_evasiondiscoverykpotspywarestealertrojan
Score
10/10

behavioral16

defense_evasiondiscoverykpotspywarestealertrojan
Score
10/10

behavioral17

defense_evasiondiscoverykpotspywarestealertrojan
Score
10/10

behavioral18

defense_evasiondiscoverykpotspywarestealertrojan
Score
10/10