amadey

General

Target

4ed06a694ba1832bb5526f2a5d52f6455f7ed317191f910d2e01d35bd8fba136
Size

273KB
Sample

230202-ea3daage91
MD5

766683884bbe6a2c0e0ea7d76b6b13ea
SHA1

793d7b457f36a560d7094e4d0fee7270cc0e6842
SHA256

4ed06a694ba1832bb5526f2a5d52f6455f7ed317191f910d2e01d35bd8fba136
SHA512

52bc438968e68e967c1513e9bb1376cf55987a3f1976cd4eb0c463bfc30eb34220c3cfb38713c24d0d6513df3823d1b18aa24857eb8010537cf986ffde6bb12a
SSDEEP

6144:vlr2XLlX3MjWzpuXgs8edJwibHbCJfAg:vlr8RX3S+AXew7bHeY

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.66

C2

193.233.20.2/Bn89hku/index.php

Extracted

Family

redline

Botnet

france

C2

193.233.20.5:4136

Attributes

auth_value
827023aa27bcc1cc2382e4d111feec6f

Extracted

Family

redline

Botnet

new1

C2

176.113.115.16:4122

Attributes

auth_value
ac44cbde6633acc9d67419c7278d5c70

Targets

- Target
  
  4ed06a694ba1832bb5526f2a5d52f6455f7ed317191f910d2e01d35bd8fba136
- Size
  
  273KB
- MD5
  
  766683884bbe6a2c0e0ea7d76b6b13ea
- SHA1
  
  793d7b457f36a560d7094e4d0fee7270cc0e6842
- SHA256
  
  4ed06a694ba1832bb5526f2a5d52f6455f7ed317191f910d2e01d35bd8fba136
- SHA512
  
  52bc438968e68e967c1513e9bb1376cf55987a3f1976cd4eb0c463bfc30eb34220c3cfb38713c24d0d6513df3823d1b18aa24857eb8010537cf986ffde6bb12a
- SSDEEP
  
  6144:vlr2XLlX3MjWzpuXgs8edJwibHbCJfAg:vlr8RX3S+AXew7bHeY
Score

10^/10

amadey redline rhadamanthys france new1 discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect rhadamanthys stealer shellcode
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1