General
-
Target
6822fac3074bb8c2aa7c5620fadd4343.bin
-
Size
1.1MB
-
Sample
230323-bpp5qacf36
-
MD5
381face5a91ea72a157a1c217ac17de8
-
SHA1
d5f66c05471894c4591ddadef041e435a066b80a
-
SHA256
fa2e54e8af66fd1e86b99eab3935806a2fb8e67d4ce4ce202fb488e80493d6a2
-
SHA512
5c225e01d67ee578e619740f7636a2e606823bee98da62e7451747c30bbbcd2fce721e395e3c638f12a23bf75a1ea614faf645d9c0af80df6ca9e7b3087dd78b
-
SSDEEP
24576:4VWU0TKJ0az4ZlhtkCXWnU9f7/heNHb50mokIX:44U04Dz4VRWnUF8bgkIX
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
relon
193.233.20.30:4125
-
auth_value
17da69809725577b595e217ba006b869
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Targets
-
-
Target
5f3fa200c828bd0e18483a43d1cb7b5ae89451a365dedc6f3c1993f057a1cb19.exe
-
Size
1.3MB
-
MD5
6822fac3074bb8c2aa7c5620fadd4343
-
SHA1
667a7575660baddef8a75dd0755c51a6341dadba
-
SHA256
5f3fa200c828bd0e18483a43d1cb7b5ae89451a365dedc6f3c1993f057a1cb19
-
SHA512
fd2205ba42e41cab4005572f68533f27d016aeeb9dc6bacd6595825d9bfc02b51ac1f9489fabbf945ab17b45fcada202b9f6e7f8d9e522b6a80a234600b547d8
-
SSDEEP
24576:potPC0g7RqtB09YBRwA/IJdqoKs/3eqc56RN0+f/gGrv:pCg7Rb9YLj+LGrsR
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-