amadey

Sharing

Copy URL

Twitter E-mail

General

Target

c0e04a96afb1ea7c6f32500e797409b8e63194400bb8f660ef43c39819997226
Size

1.8MB
Sample

240622-acq1ta1cjq
MD5

40ef797e2e3f794e820091364123a598
SHA1

e067e8509b921a99ed7ca132200c8056669499d7
SHA256

c0e04a96afb1ea7c6f32500e797409b8e63194400bb8f660ef43c39819997226
SHA512

4550d8de200ebe4cefea9ac0f50cd895c5c8a1005114748204552acf1fb725b01216c0896c88e0468350fcb9a1351e1086408d7665fb9de08ea65ec4a9b2d195
SSDEEP

24576:A36/R6ppB9Dyo26HVgxc3L94SVJh1t2DLVfSJ5/LNEekbrmPlrvrlXHMESjsn+v4:MbaoCQJhPgQ7/x+b2JHMLjkrr9

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Extracted

Family

redline

Botnet

LiveTraffic

4.185.27.237:13528

Extracted

Family

redline

Botnet

06-20-24

91.92.255.143:45786

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

95.142.46.3:4449

95.142.46.3:7000

Mutex

zlgcqgmshzbvhurfz

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

lumma

https://parallelmercywksoffw.shop/api

https://liabiliytshareodlkv.shop/api

https://notoriousdcellkw.shop/api

https://conferencefreckewl.shop/api

https://flourhishdiscovrw.shop/api

https://willingyhollowsk.shop/api

https://landdumpycolorwskfw.shop/api

https://distincttangyflippan.shop/api

https://barebrilliancedkoso.shop/api

https://macabrecondfucews.shop/api

https://greentastellesqwm.shop/api

https://stickyyummyskiwffe.shop/api

https://sturdyregularrmsnhw.shop/api

https://lamentablegapingkwaq.shop/api

https://innerverdanytiresw.shop/api

https://standingcomperewhitwo.shop/api

Targets

- Target
  
  c0e04a96afb1ea7c6f32500e797409b8e63194400bb8f660ef43c39819997226
- Size
  
  1.8MB
- MD5
  
  40ef797e2e3f794e820091364123a598
- SHA1
  
  e067e8509b921a99ed7ca132200c8056669499d7
- SHA256
  
  c0e04a96afb1ea7c6f32500e797409b8e63194400bb8f660ef43c39819997226
- SHA512
  
  4550d8de200ebe4cefea9ac0f50cd895c5c8a1005114748204552acf1fb725b01216c0896c88e0468350fcb9a1351e1086408d7665fb9de08ea65ec4a9b2d195
- SSDEEP
  
  24576:A36/R6ppB9Dyo26HVgxc3L94SVJh1t2DLVfSJ5/LNEekbrmPlrvrlXHMESjsn+v4:MbaoCQJhPgQ7/x+b2JHMLjkrr9
Score

10^/10

amadey asyncrat exelastealer lumma monster redline sectoprat stormkitty 06-20-24 @logscloudyt_bot default e76b71 livetraffic newbild defense_evasion discovery evasion execution infostealer persistence privilege_escalation pyinstaller rat spyware stealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Detects Monster Stealer.
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Monster
  Monster is a Golang stealer that was discovered in 2024.
  stealer monster
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Creates new service(s)
  persistence execution
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

AsyncRat

Detects Monster Stealer.

Exela Stealer

Lumma Stealer

Monster

RedLine

RedLine payload

SectopRAT

SectopRAT payload

StormKitty

StormKitty payload

Grants admin privileges

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Creates new service(s)

Disables Task Manager via registry modification

Downloads MZ/PE file

Modifies Windows Firewall

Stops running service(s)

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads user/profile data of web browsers

Themida packer

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Looks up external IP address via web service

Power Settings

Hide Artifacts: Hidden Files and Directories

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2