Overview

overview

10

Static

static

10

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b

  • Size

    235KB

  • Sample

    230123-empmysbf62

  • MD5

    ebd584e9c1a400cd5d4bafa0e7936468

  • SHA1

    d263c62902326425ed17855d49d35003abcd797b

  • SHA256

    ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b

  • SHA512

    e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

  • SSDEEP

    6144:pLUoeyDABOdDubDXqgraG0JzSRuVyL+VYLQqgE:plu0LgwJ4uVyaVqJ

Score
10/10
amadeyredlinevidar701@redlinevip cloud (tg: @fatherofcarders)buggyinstallsslavatanostest1discoveryinfostealerpersistencespywarestealertrojanvmprotect

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.88/9vdVVVjsw/index.php

Extracted

Family

redline

Botnet

tanos

C2

62.204.41.159:4062

Attributes
  • auth_value

    bcb77cd67cf9918d25e4b6ae210a9305

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.233:13553

Attributes
  • auth_value

    fbee175162920530e6bf470c8003fa1a

Extracted

Family

redline

Botnet

buggy

C2

62.204.41.159:4062

Attributes
  • auth_value

    f3bd7e0e0304fca899cd8bf6146ba4b3

Extracted

Family

amadey

Version

3.65

C2

hellomr.observer/7gjD0Vs3d/index.php

researchersgokick.rocks/7gjD0Vs3d/index.php

pleasetake.pictures/7gjD0Vs3d/index.php

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

redline

Botnet

test1

C2

142.202.242.197:35704

Attributes
  • auth_value

    c885160a503c10a4d67fd1c2cf98f250

Extracted

Family

vidar

Version

2.1

Botnet

701

C2

https://t.me/jetbim2

https://steamcommunity.com/profiles/76561199471266194
Attributes
  • profile_id

    701

Extracted

Family

redline

Botnet

slava

C2

81.161.229.143:26910

Attributes
  • auth_value

    1fa3bcfe9f552d4efe7e265b42c3ebff

Extracted

Family

redline

Botnet

installs

C2

194.226.121.225:12286

Attributes
  • auth_value

    10c13a3b351febb59871b098a09396b8

Targets

    • Target

      ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b

    • Size

      235KB

    • MD5

      ebd584e9c1a400cd5d4bafa0e7936468

    • SHA1

      d263c62902326425ed17855d49d35003abcd797b

    • SHA256

      ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b

    • SHA512

      e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

    • SSDEEP

      6144:pLUoeyDABOdDubDXqgraG0JzSRuVyL+VYLQqgE:plu0LgwJ4uVyaVqJ

    Score
    10/10
    amadeyredlinevidar701@redlinevip cloud (tg: @fatherofcarders)buggyinstallsslavatanostest1discoveryinfostealerpersistencespywarestealertrojanvmprotect

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks