amadey

General

Target

45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
Size

359KB
Sample

221206-mf12eace3s
MD5

e3fd151f5354feffa3ae6a284458c87f
SHA1

bf49e09e5590833fa84ae977a2c96afdd8d7a321
SHA256

45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
SHA512

126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
SSDEEP

6144:fBX5jyr2LSFHl90etgI8cerpo+yuJR6rRXRXZ4F:fBXVyyeFHl902gI8cerprzaRXL4F

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.167/v7eWcjs/index.php

Extracted

Family

redline

Botnet

nosh

C2

31.41.244.14:4683

Attributes

auth_value
7455ba4498ca1bfb73b0efbf830fb9b4

Targets

- Target
  
  45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
- Size
  
  359KB
- MD5
  
  e3fd151f5354feffa3ae6a284458c87f
- SHA1
  
  bf49e09e5590833fa84ae977a2c96afdd8d7a321
- SHA256
  
  45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
- SHA512
  
  126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
- SSDEEP
  
  6144:fBX5jyr2LSFHl90etgI8cerpo+yuJR6rRXRXZ4F:fBXVyyeFHl902gI8cerprzaRXL4F
Score

10^/10

amadey redline nosh collection discovery infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1