amadey

General

Target

276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79
Size

252KB
Sample

221112-fx3g8sha2x
MD5

d78228d99c0fe720a2e73a47c79c978b
SHA1

16e51d35e90ae2bad685c4dd06d0b6461d7d532e
SHA256

276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79
SHA512

67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e
SSDEEP

3072:6SLXqSrdSNJEdrLtJhWneR5da4QL0sBZPS4PghZKRVPB6SCBfSs7L5/Lq+BTxVnO:6AqGSN8LtJhW6da1BZP1RSdxx/zBTzn

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

boy

C2

77.73.134.241:4691

Attributes

auth_value
a91fa8cc2cfaefc42a23c03faef44bd3

Targets

- Target
  
  276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79
- Size
  
  252KB
- MD5
  
  d78228d99c0fe720a2e73a47c79c978b
- SHA1
  
  16e51d35e90ae2bad685c4dd06d0b6461d7d532e
- SHA256
  
  276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79
- SHA512
  
  67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e
- SSDEEP
  
  3072:6SLXqSrdSNJEdrLtJhWneR5da4QL0sBZPS4PghZKRVPB6SCBfSs7L5/Lq+BTxVnO:6AqGSN8LtJhW6da1BZP1RSdxx/zBTzn
Score

10^/10

amadey redline boy collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1