Triage Amadey Loader
Triage of Amadey loader
Overview
Unknown sample from MalwareBazaar. Some of the sandbox tags labeled it as amadey, we are going to validate this.
Samples
-
Packed Sample:
7ff0ff6e51a58398ad73da3cc8e7e6233a23e49d93aaa4b190672e4f9f08b9bb -
Unpacked Sample:
6e01f9d1997186d06274a508bc0a511aa6fb50e430b77efca593c00d3fc62cba
References
- ANY.RUN detects as amadey
- Intezer detects as deyma
- JoeSandbox detects as amadey
- Hatching detects as amadey
- Analyzing Amadey Loader
According to Malpedia
Amadey is a botnet that appeared around October 2018 and is being sold for about 500$ on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.
def unhex(hex_string):
import binascii
if type(hex_string) == str:
return binascii.unhexlify(hex_string.encode('utf-8'))
else:
return binascii.unhexlify(hex_string)
def tohex(data):
import binascii
if type(data) == str:
return binascii.hexlify(data.encode('utf-8'))
else:
return binascii.hexlify(data)
key_buff = b'6768875d0dd576a718d85aa1d71d25c1\x00'
data_buff = b'6679AA9D98A9C95093B7785783AA85868CA95864AEB051955760B88055'
out = []
def decrypt_string(data, key):
data = unhex(data)
key = key[1:]
out = []
for i in range(len(data)):
out.append((data[i] - key[i % len(key)]) & 0xff)
return bytes(out)
print(decrypt_string(data_buff, key_buff))
import re
FILE_PATH = '/tmp/amadey_unpacked.bin'
data = open(FILE_PATH, 'rb').read()
def get_strings():
string_egg = rb'(([A-F0-9]{2}){4,})\x00'
enc_strings = []
for m in re.finditer(string_egg, data):
enc_str = m.group(1)
enc_strings.append(enc_str)
return enc_strings
def get_keys():
key_egg = rb'([a-f0-9]{2}){8,}\x00'
keys = []
for m in re.finditer(key_egg, data):
key_str = m.group(0)
keys.append(key_str)
return keys
is_ascii = lambda s: re.match(b'^[\s!-~]+$', s)
def validate_key(keys, strings):
canary_str = max(strings, key=len)
for key in keys:
if is_ascii(decrypt_string(canary_str, key)):
return key
return None
def decrypt_strings(data):
out = []
enc_strings = get_strings()
keys = get_keys()
key = validate_key(keys, enc_strings)
if key is not None:
for s in enc_strings:
out.append(decrypt_string(s, key))
return out
strings = decrypt_strings(data)
for s in strings:
print(s)