amadey

General

Target

bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b
Size

787KB
Sample

211218-c8c5yaedb8
MD5

a048419bbecd8baf3e9620c51a19dcb0
SHA1

468c3e429b559aebb2046a8f3367ea4e52e4d30a
SHA256

bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b
SHA512

32facaca25a760af3ecdfabf561e50f8631a079ea7411484bd7565c64ea1f0b3f87060c05ff1d8535d77b726658f62ae098d622e7318b7d76929f67cc268f7a6

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.01

C2

exxxodusdomen.hk/f83jd823S/index.php

Targets

- Target
  
  bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b
- Size
  
  787KB
- MD5
  
  a048419bbecd8baf3e9620c51a19dcb0
- SHA1
  
  468c3e429b559aebb2046a8f3367ea4e52e4d30a
- SHA256
  
  bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b
- SHA512
  
  32facaca25a760af3ecdfabf561e50f8631a079ea7411484bd7565c64ea1f0b3f87060c05ff1d8535d77b726658f62ae098d622e7318b7d76929f67cc268f7a6
Score

10^/10

amadey redline discovery evasion infostealer persistence spyware stealer themida trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1