amadey

General

Target

7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727
Size

1.2MB
Sample

230224-k1s57aag56
MD5

5a9e4badd5d125446da63bf754efac64
SHA1

48ef880aacffeea83508297cd3801ab7422fab5e
SHA256

7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727
SHA512

afb5014c2f75938f737b3d21e5ca16e8985ee34965ba282406e9a321f134e587337a51d9ea7bb2772a3c3def97cf3a8e01c090e53d4ea6f292485b4211705c6e
SSDEEP

24576:CyUufpPIAj/Mj5tU3GEftI7XSrq/tQjsxmfqRKnAoyVpc:pJfXMj820tIDSWVQjqmSUAr

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Extracted

Family

redline

Botnet

funka

C2

193.233.20.20:4134

Attributes

auth_value
cdb395608d7ec633dce3d2f0c7fb0741

Extracted

Family

amadey

Version

3.67

C2

193.233.20.15/dF30Hn4m/index.php

Targets

- Target
  
  7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727
- Size
  
  1.2MB
- MD5
  
  5a9e4badd5d125446da63bf754efac64
- SHA1
  
  48ef880aacffeea83508297cd3801ab7422fab5e
- SHA256
  
  7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727
- SHA512
  
  afb5014c2f75938f737b3d21e5ca16e8985ee34965ba282406e9a321f134e587337a51d9ea7bb2772a3c3def97cf3a8e01c090e53d4ea6f292485b4211705c6e
- SSDEEP
  
  24576:CyUufpPIAj/Mj5tU3GEftI7XSrq/tQjsxmfqRKnAoyVpc:pJfXMj820tIDSWVQjqmSUAr
Score

10^/10

amadey redline funka ronur discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1