Malware sandboxing report by Hatching Triage

Sharing

Copy URL

Twitter E-mail

General

Target

46fa2dc54fd9b50e19501a15693be362b6fa6dfbd5856c0fdd63f6df55bec3c5
Size

1MB
Sample

230319-ckjb2sge7s
MD5

ce9a5c2d87c8ed4f16b64e4ef6bcb92a
SHA1

6c51e193b8b57fc4143691bc4e1cb0582566dd98
SHA256

46fa2dc54fd9b50e19501a15693be362b6fa6dfbd5856c0fdd63f6df55bec3c5
SHA512

7b23090c9f7f78f2c41f10ee0fe8b2d05ff6e7223818ab9747752dc7bdd75ea8124285e82f3cafde2ec4b29868819de22b343f24bf119c64cf62697c01b3db59
SSDEEP

12288:JMrsy90fPcRvzqcRtFELEol9G+IRNe4D1ibU89GrAXQVfIcKddwXpFJN6v+s1M+K:1ycieyjoVI64eGgQhK3wZcvlbS5P

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Targets

- Target
  
  46fa2dc54fd9b50e19501a15693be362b6fa6dfbd5856c0fdd63f6df55bec3c5
- Size
  
  1MB
- MD5
  
  ce9a5c2d87c8ed4f16b64e4ef6bcb92a
- SHA1
  
  6c51e193b8b57fc4143691bc4e1cb0582566dd98
- SHA256
  
  46fa2dc54fd9b50e19501a15693be362b6fa6dfbd5856c0fdd63f6df55bec3c5
- SHA512
  
  7b23090c9f7f78f2c41f10ee0fe8b2d05ff6e7223818ab9747752dc7bdd75ea8124285e82f3cafde2ec4b29868819de22b343f24bf119c64cf62697c01b3db59
- SSDEEP
  
  12288:JMrsy90fPcRvzqcRtFELEol9G+IRNe4D1ibU89GrAXQVfIcKddwXpFJN6v+s1M+K:1ycieyjoVI64eGgQhK3wZcvlbS5P
Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix

Collection

Data from Local System

T1005

Command and Control

Credential Access

Credentials in Files

T1081

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Tasks

static1

Score

1^/10

behavioral1

amadeyredlinegenavintdiscoveryevasioninfostealerpersistencespywarestealertrojan

Score

10^/10

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Amadey

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

MITRE ATT&CK Matrix

Tasks

static1

behavioral1