amadey

General

Target

e68accfec9356e006e37e652d1f9061d82d1f00670b9d029b32a4ceba67fa900
Size

185KB
Sample

221125-c1wmbahh3w
MD5

5adc113f37cab2c844b4d83cd2948598
SHA1

5dc4105e4760cc3f65309313e79664ca62cfb294
SHA256

57ceb1a5fb93c7ba90094e70b0f06b2c5f8ed7b9ebb0792eae7d541b538dcd0f
SHA512

26eafb767c9396fb0b09ffc2ed1d829b967b98b442baeddf02b0f50fda80894a3839bc3c1d6727abd093dad7f01cf460f97c9f4ccda0e7cbdc7aa016b4a45212
SSDEEP

3072:PAB0d1JJPMLNWjjSF1nxQNb5qjJ89e4t2QhpG9PWsWhJ4dLMO7AF2:oK1J7a1nx4qkt2Qhw9M4J3

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

1h3art.me/i4kvjd3xc/index.php

Extracted

Family

redline

Botnet

ritchshit

C2

94.103.183.33:80

Attributes

auth_value
98c1a18edcc6e04afa19a0ee3b16a6e2

Extracted

Family

raccoon

Botnet

16465d0e7bfd19684d4e56a43306c91b

C2

http://79.137.196.11/

rc4.plain

Targets

- Target
  
  e68accfec9356e006e37e652d1f9061d82d1f00670b9d029b32a4ceba67fa900
- Size
  
  246KB
- MD5
  
  d97676c845137efe4c44586ab8db7bf6
- SHA1
  
  d254580d33e716a83f12130cc3adf6efeebf7d13
- SHA256
  
  e68accfec9356e006e37e652d1f9061d82d1f00670b9d029b32a4ceba67fa900
- SHA512
  
  18f774b6615fb4858014009e1dfbeb657d2f24703861ff9db28d70cddaf64c0a926a7153a3077b4f3ee131c2f694af3321abb270c8cf0e314c68d3f8ba2bff61
- SSDEEP
  
  3072:ssMHbbVC9QYGE4LvZDjsn2nM5ykfIcU4vaSNb5qjJ8Fe4t2QhpG9tWsWhJ4dLMAn:sHtrLvZDjZPSIcUUqit2Qhw9q4JNn
Score

10^/10

amadey raccoon redline 16465d0e7bfd19684d4e56a43306c91b ritchshit infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2