amadey

General

Target

efabc7eb4ffc56984db320ae2ad6efe066eac0eb976346f90900a2d9a7542784
Size

209KB
Sample

210829-tdlw4lmb2a
MD5

aea3cabd786725878212faaae5317904
SHA1

2501cbb12c150b39ef4896a39a78066deb84b4fa
SHA256

efabc7eb4ffc56984db320ae2ad6efe066eac0eb976346f90900a2d9a7542784
SHA512

201234cf68799fcc93258845edf0d52204342f621649f37ad3bed40bebf317d1e84bf12b3a1a105e7e531e31a7edc17366c4452fccaeac2c1521dac0702975c3

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

hello

C2

80.66.87.33:36976

Extracted

Family

redline

Botnet

afansdo

C2

77.232.38.156:35454

Extracted

Family

amadey

Version

2.50

C2

185.215.113.206/k8FppT/index.php

Targets

- Target
  
  efabc7eb4ffc56984db320ae2ad6efe066eac0eb976346f90900a2d9a7542784
- Size
  
  209KB
- MD5
  
  aea3cabd786725878212faaae5317904
- SHA1
  
  2501cbb12c150b39ef4896a39a78066deb84b4fa
- SHA256
  
  efabc7eb4ffc56984db320ae2ad6efe066eac0eb976346f90900a2d9a7542784
- SHA512
  
  201234cf68799fcc93258845edf0d52204342f621649f37ad3bed40bebf317d1e84bf12b3a1a105e7e531e31a7edc17366c4452fccaeac2c1521dac0702975c3
Score

10^/10

amadey redline smokeloader afansdo hello backdoor discovery infostealer spyware stealer suricata trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1