amadey

General

Target

00089eecc8ac20425095355305a5b5cd303e33f45372b2178759aedcf9cb8308
Size

1.2MB
Sample

230318-k8rmbsdg91
MD5

d122a7db63809245d8120a05efeae581
SHA1

42c83b16c6cf983afef6ffc5a835c3fcf5bfaa3e
SHA256

00089eecc8ac20425095355305a5b5cd303e33f45372b2178759aedcf9cb8308
SHA512

deaac77f593c8048ae28098f37b2bbcb482775c388721d8da2f665208780e4d7652b5c95ebaa1d77c1e50f259e9d1822e0dac6775eb63a30b46b814179025932
SSDEEP

24576:+eIyKiLo5UtlhGsTlTEj/g6YvGwIvkSunwjxV7i3EV:+P5iElQlTE86dwIMSunwr

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

laba

C2

193.233.20.28:4125

Attributes

auth_value
2cf01cffff9092a85ca7e106c547190b

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Targets

- Target
  
  00089eecc8ac20425095355305a5b5cd303e33f45372b2178759aedcf9cb8308
- Size
  
  1.2MB
- MD5
  
  d122a7db63809245d8120a05efeae581
- SHA1
  
  42c83b16c6cf983afef6ffc5a835c3fcf5bfaa3e
- SHA256
  
  00089eecc8ac20425095355305a5b5cd303e33f45372b2178759aedcf9cb8308
- SHA512
  
  deaac77f593c8048ae28098f37b2bbcb482775c388721d8da2f665208780e4d7652b5c95ebaa1d77c1e50f259e9d1822e0dac6775eb63a30b46b814179025932
- SSDEEP
  
  24576:+eIyKiLo5UtlhGsTlTEj/g6YvGwIvkSunwjxV7i3EV:+P5iElQlTE86dwIMSunwr
Score

10^/10

amadey redline laba mango discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1