amadey

General

Target

cf4c64e20ab121c8740766b6dd10cd18d2b5085dbe30f876bae2b66952f25065
Size

191KB
Sample

221201-y7py1agh57
MD5

ca6e023ab975494e626c825e45f6873c
SHA1

03081a7f1d82ac3c88bcfac56807ffcae6e344cb
SHA256

cf4c64e20ab121c8740766b6dd10cd18d2b5085dbe30f876bae2b66952f25065
SHA512

3025694c2db5510956f5d63e6f98f14bbfd58d01abcb8de77175dc847266caed6edda5a4fc1f1edbe91d21c92cbcaf5103abba55389f1247fcd6fb5dd3764560
SSDEEP

3072:ELbmvz/Y3XIjy9IJ5tCYDeYuYTp8xiY40KwfXdObOGvvvvvv9Rs9E3AZxpR/u7UY:El3XI295QLuYp8Pd9fXdaOXvpd

Score

10^/10

Malware Config

Extracted

Family

redline

C2

37.220.87.13:40676

Attributes

auth_value
08797c5d7c548e932ae5f793280c9728

Extracted

Family

vidar

Version

56

Botnet

1148

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1148

Extracted

Family

amadey

Version

3.50

C2

62.204.41.252/nB8cWack3/index.php

Targets

- Target
  
  cf4c64e20ab121c8740766b6dd10cd18d2b5085dbe30f876bae2b66952f25065
- Size
  
  191KB
- MD5
  
  ca6e023ab975494e626c825e45f6873c
- SHA1
  
  03081a7f1d82ac3c88bcfac56807ffcae6e344cb
- SHA256
  
  cf4c64e20ab121c8740766b6dd10cd18d2b5085dbe30f876bae2b66952f25065
- SHA512
  
  3025694c2db5510956f5d63e6f98f14bbfd58d01abcb8de77175dc847266caed6edda5a4fc1f1edbe91d21c92cbcaf5103abba55389f1247fcd6fb5dd3764560
- SSDEEP
  
  3072:ELbmvz/Y3XIjy9IJ5tCYDeYuYTp8xiY40KwfXdObOGvvvvvv9Rs9E3AZxpR/u7UY:El3XI295QLuYp8Pd9fXdaOXvpd
Score

10^/10

amadey redline smokeloader vidar 1148 backdoor collection discovery infostealer spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1