amadey

Sharing

Copy URL

Twitter E-mail

General

Target

d217cd341b8abd695ce7cd54331d4288ee1d3c6ca611596b3095271e34bdc34e
Size

1.8MB
Sample

240624-xhax4s1ajm
MD5

eede5b0d9f2f23522f0f80978fe0154a
SHA1

e4e04d091c1ab62a0c7c4b0fbb8d123b675fcb75
SHA256

d217cd341b8abd695ce7cd54331d4288ee1d3c6ca611596b3095271e34bdc34e
SHA512

b097b7aa032239ce7b692c24a9348a422027b79393c95b194ce5687565ec05998c6b615d9613dd474824c87183da92533543f491779ee89a40f61888651247fd
SSDEEP

49152:hF2b0TWmAaU/u+GjMvxWJTYF+jl6YYlShSSWp9d:h40TWmAvuvM5W+F+jfYlSQHf

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Targets

- Target
  
  d217cd341b8abd695ce7cd54331d4288ee1d3c6ca611596b3095271e34bdc34e
- Size
  
  1.8MB
- MD5
  
  eede5b0d9f2f23522f0f80978fe0154a
- SHA1
  
  e4e04d091c1ab62a0c7c4b0fbb8d123b675fcb75
- SHA256
  
  d217cd341b8abd695ce7cd54331d4288ee1d3c6ca611596b3095271e34bdc34e
- SHA512
  
  b097b7aa032239ce7b692c24a9348a422027b79393c95b194ce5687565ec05998c6b615d9613dd474824c87183da92533543f491779ee89a40f61888651247fd
- SSDEEP
  
  49152:hF2b0TWmAaU/u+GjMvxWJTYF+jl6YYlShSSWp9d:h40TWmAvuvM5W+F+jfYlSQHf
Score

10^/10

amadey exelastealer monster e76b71 defense_evasion evasion persistence privilege_escalation spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Monster Stealer.
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Monster
  Monster is a Golang stealer that was discovered in 2024.
  stealer monster
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2