amadey

General

Target

a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
Size

380KB
Sample

221204-v7wvrsbc65
MD5

91176af73e5f4c5c01e6c8ce88a481a0
SHA1

e5349d540c50972802e1825c1c3dd68002f7e8b8
SHA256

a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
SHA512

7c5ddfb8d279eadfbc594d916a359269cc43dd4b17b11e0a4f9562b33adb09416aab7de6a0341c3dff1bc380f2f3e06bfa390e531322b3a6a6e2edaf871bcf70
SSDEEP

6144:XBPegtXz3z9PCY8Xv1LFMirYsy91ymlgl0KOqG1PF:XBPTpz9PCYi1LyimyWglHBG

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.167/v7eWcjs/index.php

Extracted

Family

redline

Botnet

NewDef2023

C2

185.106.92.214:2510

Attributes

auth_value
048f34b18865578890538db10b2e9edf

Targets

- Target
  
  a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
- Size
  
  380KB
- MD5
  
  91176af73e5f4c5c01e6c8ce88a481a0
- SHA1
  
  e5349d540c50972802e1825c1c3dd68002f7e8b8
- SHA256
  
  a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
- SHA512
  
  7c5ddfb8d279eadfbc594d916a359269cc43dd4b17b11e0a4f9562b33adb09416aab7de6a0341c3dff1bc380f2f3e06bfa390e531322b3a6a6e2edaf871bcf70
- SSDEEP
  
  6144:XBPegtXz3z9PCY8Xv1LFMirYsy91ymlgl0KOqG1PF:XBPTpz9PCYi1LyimyWglHBG
Score

10^/10

amadey redline newdef2023 collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1