General
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
180KB
-
Sample
221128-a9bmdsgc7w
-
MD5
de1d2e14f3126e87a80016f56fc9f647
-
SHA1
b38e95ddfe5ff1ba199968d5f38ffa62d2ff1a5d
-
SHA256
c56e8748bf7c0ba786ef8350301d2beef9a90251da0052d682b19a45f92e11d8
-
SHA512
fa7cb3ec91904afb21a3f433f5aad12d850ff8fe12a392e81b8e5d04b8aed0a39d85c1b66ffd3637dbf8dc8fde3aca22689aa55b85e97648b13aa3681c9c2507
-
SSDEEP
3072:TAi2QTiMPMGLc8Kt7kFSHFaBeQTAYA3IBDWyBQjFFOeIY65FyjwWK:MPQTiQZrKt7kFSCTBA3IkBjFsg6DNt
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Extracted
redline
slov
31.41.244.14:4694
-
auth_value
a4345b536a3d0d0e8e81ef7e5199d6d0
Extracted
redline
NewYear2023
185.106.92.111:2510
-
auth_value
99e9bde3b38509ea98c3316cc27e6106
Extracted
laplas
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Targets
-
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
237KB
-
MD5
56ea74271bbecfd918a3fc9c8bbc4b78
-
SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571
-
SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1
-
SSDEEP
3072:0+2N06qhEjfT8d5DW7ilAaBeQtAYA3IBDWyBQj8ydRQUWlUFenKomY:RXEjfToWuHtBA3IkBj7PWlUKKfY
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect Amadey credential stealer module
-
Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-