amadey

General

Target

28eb3b2d610d7526ca75770f869e86411ad681e4e98daece538c30edae2af3d8
Size

160KB
Sample

221123-xl1ypsad5v
MD5

e031a0e5c3c8e1757d38033b62795fe8
SHA1

8200f039f4c319622ec3e0974bc23c7c3c4f6604
SHA256

28eb3b2d610d7526ca75770f869e86411ad681e4e98daece538c30edae2af3d8
SHA512

c86dbcf7b769033bc79ced47cb0fbd329148f2477aad4fe634f949e8a3ed137763fe808bad5b85de8729aa920ac785388e7bc92acd679717fed37db43bbb3544
SSDEEP

3072:qCADcaN8iyu4fosLfBFzS5rz5F7oGWBQkAgetAy/m8ySwxD:uDvyu6xLfB451eBQXAy/CSwJ

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

KRIPT

C2

212.8.246.157:32348

Attributes

auth_value
80ebe4bab7a98a7ce9c75989ff9f40b4

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Extracted

Family

redline

Botnet

NanoID2022

C2

185.106.92.111:2510

Attributes

auth_value
d5913c276c6c8b5735246051bef9a412

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.233:13553

Attributes

auth_value
fbee175162920530e6bf470c8003fa1a

Extracted

Family

redline

Botnet

Variant01

C2

51.89.199.106:41383

Attributes

auth_value
f9edc1d0874114c97679c32d442c2c61

Targets

- Target
  
  28eb3b2d610d7526ca75770f869e86411ad681e4e98daece538c30edae2af3d8
- Size
  
  160KB
- MD5
  
  e031a0e5c3c8e1757d38033b62795fe8
- SHA1
  
  8200f039f4c319622ec3e0974bc23c7c3c4f6604
- SHA256
  
  28eb3b2d610d7526ca75770f869e86411ad681e4e98daece538c30edae2af3d8
- SHA512
  
  c86dbcf7b769033bc79ced47cb0fbd329148f2477aad4fe634f949e8a3ed137763fe808bad5b85de8729aa920ac785388e7bc92acd679717fed37db43bbb3544
- SSDEEP
  
  3072:qCADcaN8iyu4fosLfBFzS5rz5F7oGWBQkAgetAy/m8ySwxD:uDvyu6xLfB451eBQXAy/CSwJ
Score

10^/10

amadey redline smokeloader @redlinevip cloud (tg: @fatherofcarders)kript nanoid2022 variant01 backdoor discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1