amadey

General

Target

4099f343b3a81377413a014345ae3b962c36d80a58ade5bd2e1a9ffde277c8f4
Size

1.2MB
Sample

230317-wcyxbahd46
MD5

73ffed784595e20fa1a2325844b1558b
SHA1

c8f20c58d02fa8247ea67568b2701f9dac7e022a
SHA256

4099f343b3a81377413a014345ae3b962c36d80a58ade5bd2e1a9ffde277c8f4
SHA512

31cbb321f16e577d0c42800a1234b1236613cad50bb5cdb5c8943bca7137e4f9b971c71086e1914b8dfd04d361ba1ca36e956d963ff835e65feac6b1c48b6f54
SSDEEP

24576:e8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:e8cZSJ+ORYeYDqngTl8+c

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

laba

C2

193.233.20.28:4125

Attributes

auth_value
2cf01cffff9092a85ca7e106c547190b

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Targets

- Target
  
  4099f343b3a81377413a014345ae3b962c36d80a58ade5bd2e1a9ffde277c8f4
- Size
  
  1.2MB
- MD5
  
  73ffed784595e20fa1a2325844b1558b
- SHA1
  
  c8f20c58d02fa8247ea67568b2701f9dac7e022a
- SHA256
  
  4099f343b3a81377413a014345ae3b962c36d80a58ade5bd2e1a9ffde277c8f4
- SHA512
  
  31cbb321f16e577d0c42800a1234b1236613cad50bb5cdb5c8943bca7137e4f9b971c71086e1914b8dfd04d361ba1ca36e956d963ff835e65feac6b1c48b6f54
- SSDEEP
  
  24576:e8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:e8cZSJ+ORYeYDqngTl8+c
Score

10^/10

amadey redline laba mango discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1