amadey

General

Target

fa51107b8cffc1d77bbcc2d578d55c8b3c28e667a7917758de450a64971d4425
Size

271KB
Sample

221115-aj2qwsaf4s
MD5

2b99967fb17ba67fd0b3d65a36ea565a
SHA1

acca9ae248c8eefb11842de3565a7d69e2e63424
SHA256

fa51107b8cffc1d77bbcc2d578d55c8b3c28e667a7917758de450a64971d4425
SHA512

2d186a196c32960c058665f6eda013c1fe13269678e237a9f3ea0ac4679e7afb53bea87088e3582a80dc6bc3e54b95e96a818cda6a61280b7bd4ef7706ba2b27
SSDEEP

3072:FXOJkA2LNU8AlYW/F+Y0pEmNLhuJP9Y88j24dQ+9afmOuJXu8djuY+q6R:BEV2LNQlY4qprqO8kTP9a+OuFuFq

Score

10^/10

amadey redline @redlinevip cloud (tg: @fatherofcarders)boy collection discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boy

C2

77.73.134.241:4691

Attributes

auth_value
a91fa8cc2cfaefc42a23c03faef44bd3

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.233:13553

Attributes

auth_value
fbee175162920530e6bf470c8003fa1a

Extracted

Family

redline

C2

45.15.156.37:110

Attributes

auth_value
19cd76dae6d01d9649fd29624fa61e51

Targets

- Target
  
  fa51107b8cffc1d77bbcc2d578d55c8b3c28e667a7917758de450a64971d4425
- Size
  
  271KB
- MD5
  
  2b99967fb17ba67fd0b3d65a36ea565a
- SHA1
  
  acca9ae248c8eefb11842de3565a7d69e2e63424
- SHA256
  
  fa51107b8cffc1d77bbcc2d578d55c8b3c28e667a7917758de450a64971d4425
- SHA512
  
  2d186a196c32960c058665f6eda013c1fe13269678e237a9f3ea0ac4679e7afb53bea87088e3582a80dc6bc3e54b95e96a818cda6a61280b7bd4ef7706ba2b27
- SSDEEP
  
  3072:FXOJkA2LNU8AlYW/F+Y0pEmNLhuJP9Y88j24dQ+9afmOuJXu8djuY+q6R:BEV2LNQlY4qprqO8kTP9a+OuFuFq
Score

10^/10

amadey redline @redlinevip cloud (tg: @fatherofcarders)boy collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1