General
-
Target
c7c744981610377ba9562abccfc1793e.exe
-
Size
643KB
-
Sample
230206-nz5z5sha51
-
MD5
c7c744981610377ba9562abccfc1793e
-
SHA1
15b360b01b03c449687cebdbb180eddf06c46722
-
SHA256
ce766e4d494c2be709cd4e0d7a9c55b0acc3c3b4625bf5f2af13a3740d2935d3
-
SHA512
4e520774dbef1130f6c44afe1e36b700fbaf89156c18c8efd93235a3043ae830c5f7fc365a1f568c79782b02df84baeb3c5799b8f5ad29627fc125cf2bafcf2e
-
SSDEEP
12288:IMrxy90WcDKMcSLLt2MZcy1Sauq8oOo+XFaMMYF7ka7pgkR:pyLcDK6pZcykaIozSl7kgpX
Malware Config
Extracted
redline
bilod
193.233.20.7:4138
-
auth_value
407a8c8d5a1f9a3348afc8c6b0155512
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Targets
-
-
Target
c7c744981610377ba9562abccfc1793e.exe
-
Size
643KB
-
MD5
c7c744981610377ba9562abccfc1793e
-
SHA1
15b360b01b03c449687cebdbb180eddf06c46722
-
SHA256
ce766e4d494c2be709cd4e0d7a9c55b0acc3c3b4625bf5f2af13a3740d2935d3
-
SHA512
4e520774dbef1130f6c44afe1e36b700fbaf89156c18c8efd93235a3043ae830c5f7fc365a1f568c79782b02df84baeb3c5799b8f5ad29627fc125cf2bafcf2e
-
SSDEEP
12288:IMrxy90WcDKMcSLLt2MZcy1Sauq8oOo+XFaMMYF7ka7pgkR:pyLcDK6pZcykaIozSl7kgpX
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-