amadey | 8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd

General

Target
8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd
Size 7.1MB
Sample260706-j6he7sb18t
SHA256 8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd
MD5 1130fe776458c3e4f3779a8f037eaa0b
SHA1 ff8b0cc9c8554eec5e5c65cc1990418ec812b8f2
SHA512 fc69f785ff8733eb87fca708774a6674e992519b081b77831f18ac346f8ce06d88041293cbadd67244388ac93b03cf95a16dfdae58ea522e67949b6985b191d1
SSDEEP 196608:TuKsZTLojKaHaPSN1I0F0ekhDd7phctNO/Ecudbv:eBa6KjICLkhDdfIAEcuZ
TLSH
T11176335BF2C6206FFCF9473309F961930725EE710F24959F9A40ACAC29706266EB5372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Targets

- Target
  8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd
- Size 7.1MB
- SHA256 8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd
- MD5 1130fe776458c3e4f3779a8f037eaa0b
- SHA1 ff8b0cc9c8554eec5e5c65cc1990418ec812b8f2
- SHA512 fc69f785ff8733eb87fca708774a6674e992519b081b77831f18ac346f8ce06d88041293cbadd67244388ac93b03cf95a16dfdae58ea522e67949b6985b191d1
- SSDEEP 196608:TuKsZTLojKaHaPSN1I0F0ekhDd7phctNO/Ecudbv:eBa6KjICLkhDdfIAEcuZ
- TLSH
  T11176335BF2C6206FFCF9473309F961930725EE710F24959F9A40ACAC29706266EB5372
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

9c9aa5 drum defense_evasion discovery dropper evasion amadey healer lumma stealc persistence stealer trojan
- Detects Amadey x86-bit Payload
- Detects Healer an antivirus disabler dropper
- Family: Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Family: Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Family: Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1