amadey

General

Target

c20b07f8d71e129d0b81c7b726ff71d91dfcd98eeef46a107a47abfe40716a72
Size

322KB
Sample

221207-zjb8nsga79
MD5

f2b574e48707a497b18a4b03b5b56e98
SHA1

51e7e0e1bfca630321fa308809167448894f080b
SHA256

c20b07f8d71e129d0b81c7b726ff71d91dfcd98eeef46a107a47abfe40716a72
SHA512

0e5562854d8639830a9aed55dac340f657916e54ad75744fa62ebd63d2c631b8dca2eb2fe29ba57b7e8cf83b2c3204f96198c08af7cc2a46451e816f6a0673c0
SSDEEP

3072:2v4/EgIYcuQsiDt5B5MgqldlPxgEX4sAtmmbbGfgjZoT30mo6gpTBrBeVkhqZ9Rq:cywskcLXP9tyUo76g5Boimilf

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.237/jg94cVd30f/index.php

62.204.41.6/p9cWxH/index.php

Extracted

Family

redline

Botnet

nosh

C2

31.41.244.14:4683

Attributes

auth_value
7455ba4498ca1bfb73b0efbf830fb9b4

Extracted

Family

redline

Botnet

Newwww2023

C2

185.106.92.214:2515

Attributes

auth_value
0e2250f24c7a34075db77aa6f56e856f

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sauydga27/

Extracted

Family

cryptbot

C2

http://qalfya311.top/gate.php

Extracted

Family

vidar

Version

56.1

Botnet

1839

C2

https://t.me/dishasta

https://steamcommunity.com/profiles/76561199441933804

Attributes

profile_id
1839

Targets

- Target
  
  c20b07f8d71e129d0b81c7b726ff71d91dfcd98eeef46a107a47abfe40716a72
- Size
  
  322KB
- MD5
  
  f2b574e48707a497b18a4b03b5b56e98
- SHA1
  
  51e7e0e1bfca630321fa308809167448894f080b
- SHA256
  
  c20b07f8d71e129d0b81c7b726ff71d91dfcd98eeef46a107a47abfe40716a72
- SHA512
  
  0e5562854d8639830a9aed55dac340f657916e54ad75744fa62ebd63d2c631b8dca2eb2fe29ba57b7e8cf83b2c3204f96198c08af7cc2a46451e816f6a0673c0
- SSDEEP
  
  3072:2v4/EgIYcuQsiDt5B5MgqldlPxgEX4sAtmmbbGfgjZoT30mo6gpTBrBeVkhqZ9Rq:cywskcLXP9tyUo76g5Boimilf
Score

10^/10

amadey cryptbot redline socelars vidar 1839 newwww2023 nosh collection discovery infostealer persistence spyware stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1