General

  • Target

    c28747da62d7349ecbd18d28c526ccb92bb455c7bd10b888d21213e7a38038bb

  • Size

    250KB

  • Sample

    221201-v8wldsfg6s

  • MD5

    b02fb2fece8bd42ffe594759bea85e95

  • SHA1

    110010bbba2cd17050f5e93ff017c4e7767e15e4

  • SHA256

    c28747da62d7349ecbd18d28c526ccb92bb455c7bd10b888d21213e7a38038bb

  • SHA512

    c16acfbee7b904f657c451b0ba1cd3e1ff22ff1f2bc112d6d3d0a0625514de137102734f361dbb9a5b1e37e99cee8807d0cde6315bf9ec0df49de403e953d97c

  • SSDEEP

    3072:JQ1FmWHPrwBr5keDcvbKe0ttqnCvADtRQOgYZrerlGM/zaL9fEa2DAbEamt9h:gPrwBzDIh038+AZRBg90c2hvEa

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.167/v7eWcjs/index.php

Extracted

Family

redline

Botnet

doza

C2

31.41.244.14:4694

Attributes
  • auth_value

    3e6a3c5da2002ab5e737f7f2fc6e0cad

Extracted

Family

laplas

C2

clipper.guru

Attributes
  • api_key

    ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb

Targets

    • Target

      c28747da62d7349ecbd18d28c526ccb92bb455c7bd10b888d21213e7a38038bb

    • Size

      250KB

    • MD5

      b02fb2fece8bd42ffe594759bea85e95

    • SHA1

      110010bbba2cd17050f5e93ff017c4e7767e15e4

    • SHA256

      c28747da62d7349ecbd18d28c526ccb92bb455c7bd10b888d21213e7a38038bb

    • SHA512

      c16acfbee7b904f657c451b0ba1cd3e1ff22ff1f2bc112d6d3d0a0625514de137102734f361dbb9a5b1e37e99cee8807d0cde6315bf9ec0df49de403e953d97c

    • SSDEEP

      3072:JQ1FmWHPrwBr5keDcvbKe0ttqnCvADtRQOgYZrerlGM/zaL9fEa2DAbEamt9h:gPrwBzDIh038+AZRBg90c2hvEa

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Amadey credential stealer module

    • Laplas Clipper

      Laplas is a crypto wallet stealer with two variants written in Golang and C#.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks