amadey

General

Target

17c801f4c9484a48710362ed91b002b1f5406e95644068b361d1775ae6b7b29e
Size

310KB
Sample

221205-nysy7afg46
MD5

074aea4f0466ec20c9f7b4669578e8ac
SHA1

63ddadae65c4a15c5504c0632bfabcf9a478d603
SHA256

17c801f4c9484a48710362ed91b002b1f5406e95644068b361d1775ae6b7b29e
SHA512

b528eb13da218cb71cf5255738bc006832269603e5198bb57aebbe7c60f8c966cf35fc813423f11e9498c28dfae0f3ee682edef762fe2e9bdbe5338eb460ddca
SSDEEP

3072:IQgpJhlCORXi5lK4d9pptt2OWOra2L8ICgI/q2IC3myueNZ+59hTDw02rwlpRj5f:Y/R6dHptVr8I70J3mMNZEU02slfe2U

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

62.204.41.6/p9cWxH/index.php

Extracted

Family

redline

Botnet

NewDef2023

C2

185.106.92.214:2510

Attributes

auth_value
048f34b18865578890538db10b2e9edf

Targets

- Target
  
  17c801f4c9484a48710362ed91b002b1f5406e95644068b361d1775ae6b7b29e
- Size
  
  310KB
- MD5
  
  074aea4f0466ec20c9f7b4669578e8ac
- SHA1
  
  63ddadae65c4a15c5504c0632bfabcf9a478d603
- SHA256
  
  17c801f4c9484a48710362ed91b002b1f5406e95644068b361d1775ae6b7b29e
- SHA512
  
  b528eb13da218cb71cf5255738bc006832269603e5198bb57aebbe7c60f8c966cf35fc813423f11e9498c28dfae0f3ee682edef762fe2e9bdbe5338eb460ddca
- SSDEEP
  
  3072:IQgpJhlCORXi5lK4d9pptt2OWOra2L8ICgI/q2IC3myueNZ+59hTDw02rwlpRj5f:Y/R6dHptVr8I70J3mMNZEU02slfe2U
Score

10^/10

amadey redline newdef2023 collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1