amadey

General

Target

d1a2077e3d59164d048af262b1c46d86a17e53bfcac0de63e860687bec1e58f8.exe
Size

332KB
Sample

221208-bd7kmagf65
MD5

8897e86f7add4213cab47fc06334f5b4
SHA1

b83f23dccb3c90b6cf97f4155563ba5b81aaea10
SHA256

d1a2077e3d59164d048af262b1c46d86a17e53bfcac0de63e860687bec1e58f8
SHA512

dd7078bacc4257cf5d7bb3246f39900637bc1add0e3389bc724f1e2fc9594cad7218cdb49ffe26952f6b1483e6d8efd9f4921657e7ae6bd2f194a594accb25d6
SSDEEP

6144:7aweSV0timaGR9a/JdnrJLHuiu5lSIDcrBVS:7aZSCtimRR9a/JOHDcrBVS

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.167/v7eWcjs/index.php

31.41.244.237/jg94cVd30f/index.php

62.204.41.6/p9cWxH/index.php

Extracted

Family

redline

Botnet

nosh

C2

31.41.244.14:4683

Attributes

auth_value
7455ba4498ca1bfb73b0efbf830fb9b4

Extracted

Family

redline

Botnet

globaltrc20

C2

185.106.92.214:2515

Attributes

auth_value
e1205a807a50988797ccb9a0d99697af

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sauydga27/

Targets

- Target
  
  d1a2077e3d59164d048af262b1c46d86a17e53bfcac0de63e860687bec1e58f8.exe
- Size
  
  332KB
- MD5
  
  8897e86f7add4213cab47fc06334f5b4
- SHA1
  
  b83f23dccb3c90b6cf97f4155563ba5b81aaea10
- SHA256
  
  d1a2077e3d59164d048af262b1c46d86a17e53bfcac0de63e860687bec1e58f8
- SHA512
  
  dd7078bacc4257cf5d7bb3246f39900637bc1add0e3389bc724f1e2fc9594cad7218cdb49ffe26952f6b1483e6d8efd9f4921657e7ae6bd2f194a594accb25d6
- SSDEEP
  
  6144:7aweSV0timaGR9a/JdnrJLHuiu5lSIDcrBVS:7aZSCtimRR9a/JOHDcrBVS
Score

10^/10

amadey redline socelars globaltrc20 nosh collection infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Amadey credential stealer module
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2