amadey

General

Target

17f279ca8d582a62bc6050b3fdcad8875b57f6038de7b8260743cc559c8bb885
Size

146KB
Sample

221126-en2c5sec2w
MD5

163eeebe556362bedac7d92e83101c92
SHA1

3265e8f8c8197c1edc7dcac369968584f7dceca2
SHA256

17f279ca8d582a62bc6050b3fdcad8875b57f6038de7b8260743cc559c8bb885
SHA512

28f1203b272f73cd623995af3bb9664d122291818c01f60790a0249b410dba4a2331c1a2c18c0bcbf4d5f9b5b49275803aaa856f238783386504b22913598325
SSDEEP

3072:TJlMQT7bqGIR659mJBtTh4uqBAa1d6WgZ:TsybqG4JBtlZqBbf+

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.194/h49vlBP/index.php

Extracted

Family

redline

Botnet

KRIPT

C2

212.8.246.157:32348

Attributes

auth_value
80ebe4bab7a98a7ce9c75989ff9f40b4

Extracted

Family

laplas

C2

clipper.guru

Attributes

api_key
c25400a81a220bbbc3cb779c59ab8b74c7b58ae3a99f465520cbd86c53bd630b

Targets

- Target
  
  17f279ca8d582a62bc6050b3fdcad8875b57f6038de7b8260743cc559c8bb885
- Size
  
  146KB
- MD5
  
  163eeebe556362bedac7d92e83101c92
- SHA1
  
  3265e8f8c8197c1edc7dcac369968584f7dceca2
- SHA256
  
  17f279ca8d582a62bc6050b3fdcad8875b57f6038de7b8260743cc559c8bb885
- SHA512
  
  28f1203b272f73cd623995af3bb9664d122291818c01f60790a0249b410dba4a2331c1a2c18c0bcbf4d5f9b5b49275803aaa856f238783386504b22913598325
- SSDEEP
  
  3072:TJlMQT7bqGIR659mJBtTh4uqBAa1d6WgZ:TsybqG4JBtlZqBbf+
Score

10^/10

amadey laplas redline smokeloader kript backdoor collection infostealer spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- Laplas Clipper
  Laplas is a crypto wallet stealer with two variants written in Golang and C#.
  stealer laplas
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1