amadey

General

Target
2026-02-02_129b8d1dc9721cd5bf3d52869d949e1d_cryptbot_icedid_luca-stealer_njrat_stealc
Size 6.6MB
Sample260202-2nlc9afs8h
SHA256 0cd2c1945efb55d737c9be277f7c7e7a2ccb593d414f0b32686e9ff0512571e5
MD5 129b8d1dc9721cd5bf3d52869d949e1d
SHA1 ac4b1ae9ca1c2ac6ba5506fb69619b967c83b16b
SHA512 b8e254a0ab0b98df151ceebf1e3e83193edb30273ba980668908b4a68c4e691b8c6a6862b1f2a363c38f4b0ee12cd37a0538140402f48cd66b529f13742be1ef
SSDEEP 196608:DSr7qG272YVTeIUCbo6/q0msP3eRGxYn/5xLEYhmmPPgsVTKYTW:DSr69UCPLmsPed/5xpPnp5W
TLSH
T13866331AD6E404F8E5B3E1B9CE824A07EF797C4A4771E74F47A554660F232A08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Extracted

Family

lumma

C2

https://backsan.cyou/api
https://whitepepper.su/asds
https://hammernew.su/asdase
https://heavylussy.su/ccvfd
https://broguenko.su/asfase
https://homuncloud.su/ascasef
https://familyriwo.su/fssdaw
https://izzardtow.su/cascasc
https://basilicros.su/asdasq

Attributes

build_id
f92cf74169c009cef5fa6c49958a8dea129dc0c2d9b363be

Extracted

Family

lclipper

C2

https://api.telegram.org/bot7841921350:AAFGkor-dSPkf-PgNgU6DqA2BBmIM8f_vRU/sendMessage?chat_id=6299414420&text=

Extracted

Family

stealc

Botnet

qwfwrgf

C2

http://158.94.210.74

Attributes

url_path
/4d4b240c75954580.php

rc4.plain

Targets

- Target
  2026-02-02_129b8d1dc9721cd5bf3d52869d949e1d_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 6.6MB
- SHA256 0cd2c1945efb55d737c9be277f7c7e7a2ccb593d414f0b32686e9ff0512571e5
- MD5 129b8d1dc9721cd5bf3d52869d949e1d
- SHA1 ac4b1ae9ca1c2ac6ba5506fb69619b967c83b16b
- SHA512 b8e254a0ab0b98df151ceebf1e3e83193edb30273ba980668908b4a68c4e691b8c6a6862b1f2a363c38f4b0ee12cd37a0538140402f48cd66b529f13742be1ef
- SSDEEP 196608:DSr7qG272YVTeIUCbo6/q0msP3eRGxYn/5xLEYhmmPPgsVTKYTW:DSr69UCPLmsPed/5xpPnp5W
- TLSH
  T13866331AD6E404F8E5B3E1B9CE824A07EF797C4A4771E74F47A554660F232A08E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

gcleaner lumma loader stealer qwfwrgf defense_evasion discovery execution amadey lclipper quasar stealc vidar installer persistence privilege_escalation pyinstaller spyware trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Amadey family
  amadey
- Detects Amadey x86-bit Payload
- Detects Vidar Stealer
  stealer
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- LClipper
  LClipper is a stealer written in C++.
  stealer lclipper
- Lclipper family
  lclipper
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Stealc family
  stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar family
  vidar
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2