amadey

General

Target

f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
Size

244KB
Sample

221124-aa9edahb8s
MD5

2e795a9e52afa69f803f2bb1201b8a36
SHA1

269af084a0dcb713e70d603bca106023e742cf09
SHA256

f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
SHA512

a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
SSDEEP

6144:hXOhLM4GbDkfXtdWmqfWmDKSLzjP88N42YL:hXkVGbD2dwfBKb

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

185.246.221.126/i4kvjd3xc/index.php

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.233:13553

Attributes

auth_value
fbee175162920530e6bf470c8003fa1a

Extracted

Family

netwire

C2

alice2019.myftp.biz:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Fs_Spread_0001
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Targets

- Target
  
  f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
- Size
  
  244KB
- MD5
  
  2e795a9e52afa69f803f2bb1201b8a36
- SHA1
  
  269af084a0dcb713e70d603bca106023e742cf09
- SHA256
  
  f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
- SHA512
  
  a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
- SSDEEP
  
  6144:hXOhLM4GbDkfXtdWmqfWmDKSLzjP88N42YL:hXkVGbD2dwfBKb
Score

10^/10

amadey netwire redline @redlinevip cloud (tg: @fatherofcarders)botnet discovery infostealer persistence rat spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1