amadey

General

Target

780e633b56607c091dcf8b6cdde49fc66d1a343c067369eac6d45c28247b0f06
Size

243KB
Sample

221130-z6vzasfd95
MD5

db745dc6374c0b2ed58ecd74b1940fd0
SHA1

fd6313c7f08cccb66f0a98a13bad7c7ed61108e2
SHA256

780e633b56607c091dcf8b6cdde49fc66d1a343c067369eac6d45c28247b0f06
SHA512

e77f7632b9b1a1a4d78454bbe26b1c81535d08cc54a0e381ad7c0a02238ec8347c79c8242d5db1cbe78a2332560fa546ec1df48ad9c3495b4d0f88221e9fd23e
SSDEEP

6144:GMEU0V8hQmbym8CnP1Evx4ujRk6eh+Ml:GMb+HM8C9EvltBgR

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

62.204.41.252/nB8cWack3/index.php

Extracted

Family

vidar

Version

55.9

Botnet

909

C2

https://t.me/headshotsonly

https://steamcommunity.com/profiles/76561199436777531

Attributes

profile_id
909

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.233:13553

Attributes

auth_value
fbee175162920530e6bf470c8003fa1a

Extracted

Family

redline

Botnet

Lege

C2

31.41.244.14:4694

Attributes

auth_value
096090aaf3ba0872338140cec5689868

Targets

- Target
  
  780e633b56607c091dcf8b6cdde49fc66d1a343c067369eac6d45c28247b0f06
- Size
  
  243KB
- MD5
  
  db745dc6374c0b2ed58ecd74b1940fd0
- SHA1
  
  fd6313c7f08cccb66f0a98a13bad7c7ed61108e2
- SHA256
  
  780e633b56607c091dcf8b6cdde49fc66d1a343c067369eac6d45c28247b0f06
- SHA512
  
  e77f7632b9b1a1a4d78454bbe26b1c81535d08cc54a0e381ad7c0a02238ec8347c79c8242d5db1cbe78a2332560fa546ec1df48ad9c3495b4d0f88221e9fd23e
- SSDEEP
  
  6144:GMEU0V8hQmbym8CnP1Evx4ujRk6eh+Ml:GMb+HM8C9EvltBgR
Score

10^/10

amadey redline vidar 909 @redlinevip cloud (tg: @fatherofcarders)lege collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1