amadey

General

Target

0bf61c54c2ec4f608da49f2b2f831d01377a5350cfab03e007d1ad4addadd012
Size

632KB
Sample

230206-g421qacd23
MD5

7819b54eab4d63fd1fd46827166c00f8
SHA1

1ab7cb6b00a691280e007ebddd45997c862d1757
SHA256

0bf61c54c2ec4f608da49f2b2f831d01377a5350cfab03e007d1ad4addadd012
SHA512

9e1ddb9545e03f8d3231cf46e3e6bbc4b1ef7e7d493cb71c8fc6ecaf63774c2b59aeb4be1962b501d35a036b986c4c35f5f0f23f421bfab58420e8f6e29876f8
SSDEEP

12288:0MrBy90Ws4g6RJXCSO1rTIcjXZcupTd5ppfnYVl:9yQX67CSOVIcjKu35Lfne

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

62.204.41.88/9vdVVVjsw/index.php

Extracted

Family

redline

Botnet

temposs6678

C2

82.115.223.9:15486

Attributes

auth_value
af399e6a2fe66f67025541cf71c64313

Extracted

Family

redline

Botnet

ringo1

C2

176.113.115.16:4122

Attributes

auth_value
373b070fb57b7689445f097000cbd6c2

Extracted

Family

redline

Botnet

ringo

C2

176.113.115.16:4122

Attributes

auth_value
b8f864b25d84b5ed5591e4bfa647cdbe

Extracted

Family

redline

C2

8.9.31.171:21237

Attributes

auth_value
a45e539240f6577c0a8f730c3eef20a1

Targets

- Target
  
  0bf61c54c2ec4f608da49f2b2f831d01377a5350cfab03e007d1ad4addadd012
- Size
  
  632KB
- MD5
  
  7819b54eab4d63fd1fd46827166c00f8
- SHA1
  
  1ab7cb6b00a691280e007ebddd45997c862d1757
- SHA256
  
  0bf61c54c2ec4f608da49f2b2f831d01377a5350cfab03e007d1ad4addadd012
- SHA512
  
  9e1ddb9545e03f8d3231cf46e3e6bbc4b1ef7e7d493cb71c8fc6ecaf63774c2b59aeb4be1962b501d35a036b986c4c35f5f0f23f421bfab58420e8f6e29876f8
- SSDEEP
  
  12288:0MrBy90Ws4g6RJXCSO1rTIcjXZcupTd5ppfnYVl:9yQX67CSOVIcjKu35Lfne
Score

10^/10

amadey redline rhadamanthys ringo ringo1 temposs6678 discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect rhadamanthys stealer shellcode
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1