Overview

overview

10

Static

static

10

7df62e61b9...fe.exe

windows7_x64

10

7df62e61b9...fe.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7df62e61b9b349f8f540410d6ae435fe.exe

  • Size

    663KB

  • Sample

    211221-t78znaebc2

  • MD5

    7df62e61b9b349f8f540410d6ae435fe

  • SHA1

    e92166335343fce4ee637a6e207b2521f60edb11

  • SHA256

    886b0ccaf90c375e204631606396feee470aaf07e4c2f30608f45c4d72f1fb28

  • SHA512

    433835309d04ffecd460eb588b01dbb9bfa40533b256c5daf6d1c1c8a5b14060d2c67894aeb66b74bb868709d68394c9404bf8c10656a9568d83bde4d12d60e8

Score
10/10
amadeyneshtaredlinerunpediscoveryinfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

2.86

C2

2.56.56.210/notAnoob/index.php

Extracted

Family

redline

Botnet

runpe

C2

142.202.242.172:7667

Targets

    • Target

      7df62e61b9b349f8f540410d6ae435fe.exe

    • Size

      663KB

    • MD5

      7df62e61b9b349f8f540410d6ae435fe

    • SHA1

      e92166335343fce4ee637a6e207b2521f60edb11

    • SHA256

      886b0ccaf90c375e204631606396feee470aaf07e4c2f30608f45c4d72f1fb28

    • SHA512

      433835309d04ffecd460eb588b01dbb9bfa40533b256c5daf6d1c1c8a5b14060d2c67894aeb66b74bb868709d68394c9404bf8c10656a9568d83bde4d12d60e8

    Score
    10/10
    amadeyneshtaredlinerunpediscoveryinfostealerpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks