amadey

General

Target

d22b54f7cda2549f62b591cf2f57f76aae3e1b0460f23f57e389819af393a770
Size

189KB
Sample

221111-rlr3xaah4v
MD5

aa6f6b17c8aebca4a49f6c2fc58f5d49
SHA1

128d359425698502e000b1849b1ef9ae227b1335
SHA256

d22b54f7cda2549f62b591cf2f57f76aae3e1b0460f23f57e389819af393a770
SHA512

f01c8fbcb4170085584c46c917b3562fb2f86c375cc1feefd8a061958493f411a8c719e164ded04849f48793347ddfe19aa85e1c5693f29c2d5259314234e1bf
SSDEEP

3072:YXXOtqP5b8L7O2ivbR0hX2gaC3Q5yXcFOwbPyS/pJE:CO6AL7O2i+hX2i3QJvPjp

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

Google2

C2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Extracted

Family

asyncrat

Version

Venom RAT 5.0.5

Botnet

Client4

C2

46.3.199.101:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Windows Security Shell.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  d22b54f7cda2549f62b591cf2f57f76aae3e1b0460f23f57e389819af393a770
- Size
  
  189KB
- MD5
  
  aa6f6b17c8aebca4a49f6c2fc58f5d49
- SHA1
  
  128d359425698502e000b1849b1ef9ae227b1335
- SHA256
  
  d22b54f7cda2549f62b591cf2f57f76aae3e1b0460f23f57e389819af393a770
- SHA512
  
  f01c8fbcb4170085584c46c917b3562fb2f86c375cc1feefd8a061958493f411a8c719e164ded04849f48793347ddfe19aa85e1c5693f29c2d5259314234e1bf
- SSDEEP
  
  3072:YXXOtqP5b8L7O2ivbR0hX2gaC3Q5yXcFOwbPyS/pJE:CO6AL7O2i+hX2i3QJvPjp
Score

10^/10

amadey asyncrat redline smokeloader client4 google2 backdoor collection infostealer persistence rat spyware stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1