amadey

General

Target

bff15961c6100bf76db0f20f434cd069.exe
Size

221KB
Sample

221118-2ss9nabf65
MD5

bff15961c6100bf76db0f20f434cd069
SHA1

7ffcc4359779c74ca2b78526acbfbd147b097de1
SHA256

25ae1edc4fb4a251433e427c5ba19bf597e242befe7cb836da692f2cbb2949ed
SHA512

f1ec4e7220b65b27456d2d822fd609180d6eb781b08191b7537a972fcbab252ecb41eda85aa85ee783f3eb6fe6cf2c9a5f235eebfbf753af652dded22708d8d6
SSDEEP

6144:m8eY52kweddYIRDvxw4rjloyF8ICap6rx:m8efkw+YIRDZGna4

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Extracted

Family

redline

Botnet

Suza

C2

77.73.134.241:4691

Attributes

auth_value
9aad6c7f3c541488d1c10773e9b275c9

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Targets

- Target
  
  bff15961c6100bf76db0f20f434cd069.exe
- Size
  
  221KB
- MD5
  
  bff15961c6100bf76db0f20f434cd069
- SHA1
  
  7ffcc4359779c74ca2b78526acbfbd147b097de1
- SHA256
  
  25ae1edc4fb4a251433e427c5ba19bf597e242befe7cb836da692f2cbb2949ed
- SHA512
  
  f1ec4e7220b65b27456d2d822fd609180d6eb781b08191b7537a972fcbab252ecb41eda85aa85ee783f3eb6fe6cf2c9a5f235eebfbf753af652dded22708d8d6
- SSDEEP
  
  6144:m8eY52kweddYIRDvxw4rjloyF8ICap6rx:m8efkw+YIRDZGna4
Score

10^/10

amadey eternity redline suza collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2