amadey

General

Target

549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690
Size

246KB
Sample

221124-3w411agd56
MD5

0ffc57a0b455d613e887e58cced3797e
SHA1

10e652967ea3e4140be52f4f7a77f4308e87fe93
SHA256

549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690
SHA512

9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf
SSDEEP

6144:frdmLwvhK59diSwBkSdI1PZTCcpw85P7Nq6:frdmkvha9I61PJpV5U

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Extracted

Family

redline

Botnet

5139967220

C2

79.137.192.6:8362

Extracted

Family

laplas

C2

79.137.206.137

Attributes

api_key
0f183cb4288647960d1c458ed8456bf6524ebfbc16ebc53caab66c2376fd0eef

Targets

- Target
  
  549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690
- Size
  
  246KB
- MD5
  
  0ffc57a0b455d613e887e58cced3797e
- SHA1
  
  10e652967ea3e4140be52f4f7a77f4308e87fe93
- SHA256
  
  549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690
- SHA512
  
  9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf
- SSDEEP
  
  6144:frdmLwvhK59diSwBkSdI1PZTCcpw85P7Nq6:frdmkvha9I61PJpV5U
Score

10^/10

amadey laplas redline 5139967220 evasion infostealer persistence spyware stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Laplas Clipper
  Laplas is a crypto wallet stealer with two variants written in Golang and C#.
  stealer laplas
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- UAC bypass
  evasion trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1