amadey

General

Target

eea3064653587e54a46988beb77026830141417a8a552c4b5d1f1d4e0dbdef65
Size

512KB
Sample

230204-tzs88sdg56
MD5

8dc40ddf53bdc0472a2e7cb61b270d48
SHA1

55fd9d5be6d20253c7d16b8e0e0cb0bf19882ab4
SHA256

eea3064653587e54a46988beb77026830141417a8a552c4b5d1f1d4e0dbdef65
SHA512

018b2a33bca187abac7fc2674c9674e527a30f99cb5c36b9db3a2327217ddfe27e4df97c7a11eaec896e02fd7ec61a2482259eb25848106513e25793951e1a6a
SSDEEP

12288:mpVtpCnslXsgHUev1+GH3/34MePurA89QHn56feSa+AgqH:AvmgHUe1+83fvckBQHMWgqH

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

redko

C2

62.204.41.170:4179

Attributes

auth_value
9bcf7b0620ff067017d66b9a5d80b547

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Extracted

Family

redline

Botnet

mixo

C2

176.113.115.16:4122

Attributes

auth_value
f8c6749529d254a59e80682dd4ba63f6

Extracted

Family

redline

Botnet

gonka

C2

62.204.41.170:4179

Attributes

auth_value
f017b1096da5cc257f8ca109051c5fbb

Extracted

Family

redline

Botnet

temposs6678

C2

82.115.223.9:15486

Attributes

auth_value
af399e6a2fe66f67025541cf71c64313

Targets

- Target
  
  eea3064653587e54a46988beb77026830141417a8a552c4b5d1f1d4e0dbdef65
- Size
  
  512KB
- MD5
  
  8dc40ddf53bdc0472a2e7cb61b270d48
- SHA1
  
  55fd9d5be6d20253c7d16b8e0e0cb0bf19882ab4
- SHA256
  
  eea3064653587e54a46988beb77026830141417a8a552c4b5d1f1d4e0dbdef65
- SHA512
  
  018b2a33bca187abac7fc2674c9674e527a30f99cb5c36b9db3a2327217ddfe27e4df97c7a11eaec896e02fd7ec61a2482259eb25848106513e25793951e1a6a
- SSDEEP
  
  12288:mpVtpCnslXsgHUev1+GH3/34MePurA89QHn56feSa+AgqH:AvmgHUe1+83fvckBQHMWgqH
Score

10^/10

amadey redline rhadamanthys gonka mixo redko temposs6678 discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect rhadamanthys stealer shellcode
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1