amadey

General

Target

f71254abbe313f41bb519ea95f3ce79a7b29688d3415b61c82fd1b200f189598
Size

209KB
Sample

210829-947n2lstms
MD5

a2bfca1d72267b9678a88e880084baa5
SHA1

171ab25f1e501ee71c4d637059ca8c1b985eef2a
SHA256

f71254abbe313f41bb519ea95f3ce79a7b29688d3415b61c82fd1b200f189598
SHA512

0a36afbc08ed3197460aab16f17a231cb83639def21f6ea9561a24128d7ae56807f1dbc9b187539090695a02235b32e116d01c8c2e24476741aa301f8ea3bb9d

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

hello

C2

80.66.87.33:36976

Extracted

Family

amadey

Version

2.50

C2

185.215.113.206/k8FppT/index.php

Extracted

Family

redline

Botnet

afansdo

C2

77.232.38.156:35454

Extracted

Family

amadey

Version

2.31

C2

x-vpn.ug/hfV3vDtt/index.php

Targets

- Target
  
  f71254abbe313f41bb519ea95f3ce79a7b29688d3415b61c82fd1b200f189598
- Size
  
  209KB
- MD5
  
  a2bfca1d72267b9678a88e880084baa5
- SHA1
  
  171ab25f1e501ee71c4d637059ca8c1b985eef2a
- SHA256
  
  f71254abbe313f41bb519ea95f3ce79a7b29688d3415b61c82fd1b200f189598
- SHA512
  
  0a36afbc08ed3197460aab16f17a231cb83639def21f6ea9561a24128d7ae56807f1dbc9b187539090695a02235b32e116d01c8c2e24476741aa301f8ea3bb9d
Score

10^/10

amadey redline smokeloader afansdo hello backdoor discovery infostealer spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1