amadey | 35c93c643baf3be8c08584d59d11a9b60c8064a38f43affd560d839c7372c9e8

General

Target
35c93c643baf3be8c08584d59d11a9b60c8064a38f43affd560d839c7372c9e8
Size 7.0MB
Sample260719-3c79bafx4l
SHA256 35c93c643baf3be8c08584d59d11a9b60c8064a38f43affd560d839c7372c9e8
MD5 a49411c77bfe5b6e092ccddcea2d0a97
SHA1 cd5f63ec9e8c703455d912bde83ec95dcd04a4a1
SHA512 af94fb886be06785f9faf5e4d5d69e6fd27f106a17435a9286e5c8836e856c6e254d6f5abd464f89c4a96ec9093d6092a820f8f8d9f8b961935420a76211bee0
SSDEEP 196608:jiERk1QbWoOumpV7gLds0wZ70LB4mOzdDMDzzYACLkQcy:+qkabWQv2h0VqzdDMOLkQcy
TLSH
T1527633EF55EDD022C67053F15F9A528702363E9220225A2377EFDA2A1DF66105B30B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://preside-comforter.sbs/api
https://savvy-steereo.sbs/api
https://copper-replace.sbs/api
https://record-envyp.sbs/api
https://slam-whipp.sbs/api
https://wrench-creter.sbs/api
https://looky-marked.sbs/api
https://plastic-mitten.sbs/api
https://hallowed-noisy.sbs/api

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Targets

- Target
  35c93c643baf3be8c08584d59d11a9b60c8064a38f43affd560d839c7372c9e8
- Size 7.0MB
- SHA256 35c93c643baf3be8c08584d59d11a9b60c8064a38f43affd560d839c7372c9e8
- MD5 a49411c77bfe5b6e092ccddcea2d0a97
- SHA1 cd5f63ec9e8c703455d912bde83ec95dcd04a4a1
- SHA512 af94fb886be06785f9faf5e4d5d69e6fd27f106a17435a9286e5c8836e856c6e254d6f5abd464f89c4a96ec9093d6092a820f8f8d9f8b961935420a76211bee0
- SSDEEP 196608:jiERk1QbWoOumpV7gLds0wZ70LB4mOzdDMDzzYACLkQcy:+qkabWQv2h0VqzdDMOLkQcy
- TLSH
  T1527633EF55EDD022C67053F15F9A528702363E9220225A2377EFDA2A1DF66105B30B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

9c9aa5 mars defense_evasion discovery dropper evasion amadey healer lumma stealc persistence stealer trojan
- Detects Amadey x86-bit Payload
- Detects Healer an antivirus disabler dropper
- Family: Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Family: Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Family: Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1