amadey

General

Target

1f32d31312ef205531030ae0cb1bcd78.exe
Size

222KB
Sample

221117-r4qmssaf51
MD5

1f32d31312ef205531030ae0cb1bcd78
SHA1

dd09f691719633623397985e85fc2af01ee99158
SHA256

845d58361d94e714e6c56e856513d5717b9d846939f586c09c728d70440e7137
SHA512

e43a73edef0867888b6ec23e987d6cc9fba1a26151e1d5f3933e1e703658ad3b4098a58d060bb4a9d3d5393395b2f7067be14c7f55b0569d9c29adbe39579742
SSDEEP

3072:1qiVocKJs1Pc5FGFgH1jgXSKGQMzDrhC5GmljhvmTsO+sWnxGR96UDcD:1PPWsMLjeGaGml9mTsp0R96U

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Extracted

Family

redline

Botnet

Suza

C2

77.73.134.241:4691

Attributes

auth_value
9aad6c7f3c541488d1c10773e9b275c9

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Targets

- Target
  
  1f32d31312ef205531030ae0cb1bcd78.exe
- Size
  
  222KB
- MD5
  
  1f32d31312ef205531030ae0cb1bcd78
- SHA1
  
  dd09f691719633623397985e85fc2af01ee99158
- SHA256
  
  845d58361d94e714e6c56e856513d5717b9d846939f586c09c728d70440e7137
- SHA512
  
  e43a73edef0867888b6ec23e987d6cc9fba1a26151e1d5f3933e1e703658ad3b4098a58d060bb4a9d3d5393395b2f7067be14c7f55b0569d9c29adbe39579742
- SSDEEP
  
  3072:1qiVocKJs1Pc5FGFgH1jgXSKGQMzDrhC5GmljhvmTsO+sWnxGR96UDcD:1PPWsMLjeGaGml9mTsp0R96U
Score

10^/10

amadey eternity redline suza collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2