amadey

General

Target

bca708f0ac1ce954e4fdbcf27112730830d335e4640adec4ce6c23826685c535.exe
Size

332KB
Sample

221208-b68y6agg25
MD5

ad0fceb79f9f81c6e7dc000b0ef25461
SHA1

08a24528ea19a1828e9a5f7a654d06afb6276cca
SHA256

bca708f0ac1ce954e4fdbcf27112730830d335e4640adec4ce6c23826685c535
SHA512

4c419f04b7dece3820f14f858f451dfafdd06b1d3e7c981a4a50920902c369093b76ff47f39639ffab7159ef5e153379eac912fffd33b4b41054e3a2eacb4767
SSDEEP

6144:9aGm12yG2MJAgTC1gTapwr6GEXjAiX0IDcBJuAVS:9ax1xGdOEopB5BDcBJuAVS

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

62.204.41.6/p9cWxH/index.php

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sauydga27/

Extracted

Family

redline

Botnet

wosh

C2

31.41.244.14:4683

Attributes

auth_value
f0ec85e2aaa9e62929e2fb9e09d843f4

Targets

- Target
  
  bca708f0ac1ce954e4fdbcf27112730830d335e4640adec4ce6c23826685c535.exe
- Size
  
  332KB
- MD5
  
  ad0fceb79f9f81c6e7dc000b0ef25461
- SHA1
  
  08a24528ea19a1828e9a5f7a654d06afb6276cca
- SHA256
  
  bca708f0ac1ce954e4fdbcf27112730830d335e4640adec4ce6c23826685c535
- SHA512
  
  4c419f04b7dece3820f14f858f451dfafdd06b1d3e7c981a4a50920902c369093b76ff47f39639ffab7159ef5e153379eac912fffd33b4b41054e3a2eacb4767
- SSDEEP
  
  6144:9aGm12yG2MJAgTC1gTapwr6GEXjAiX0IDcBJuAVS:9ax1xGdOEopB5BDcBJuAVS
Score

10^/10

amadey redline socelars wosh collection infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2