amadey

General

Target

2411653655b03e21b87a7684d6ab1539.bin
Size

993KB
Sample

230328-bldmhsaa7s
MD5

7dec39d998706e6ef9a50ed8052972a4
SHA1

4ff6ae0f48b3dd0c5eae674fcbd88548b4a46bd4
SHA256

a272cf7c05ba66944ee1d4dee2909597d288e00503af388d65981a2f515eda4c
SHA512

16d892ea61b884e48f750f3cb343e57cbfaad87497ca87783794b7e0251a14f2830c4c21b14b0f370a2ef6e9da7f5ef7c89f87aa26db65f8fb480fcbe3f9c38d
SSDEEP

24576:gIAj0qNAYxxuHGbdC43V3GWeDCH1rk6gYtkXt/8Oq:riqmbdCuVWW11kPXN4

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

fort

C2

193.233.20.33:4125

Attributes

auth_value
5ea5673154a804d8c80f565f7276f720

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Extracted

Family

raccoon

Botnet

301867536c206e3dae52e6d17c16cc9b

C2

http://213.226.100.108/

rc4.plain

Extracted

Family

aurora

C2

212.87.204.93:8081

Targets

- Target
  
  315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec.exe
- Size
  
  1.0MB
- MD5
  
  2411653655b03e21b87a7684d6ab1539
- SHA1
  
  2a296c22ca1f499fb8735fcae8c2be6064a4cbcf
- SHA256
  
  315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec
- SHA512
  
  f8e3fd805951a0a9d9b47789f9d118c60bc2b954a634cf6a727f88e5e076c33f4302543857f87d357e6a92f1b4d46be02f5df68a537daced74b36eab0f667d26
- SSDEEP
  
  24576:3y5Hm2RBA5C5+L/sb/perCZcbxEhP2H9M/U1ef:CN8tkb/peWONc2H9a
Score

10^/10

amadey aurora raccoon redline 301867536c206e3dae52e6d17c16cc9b fort sony discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Aurora
  Aurora is a crypto wallet stealer written in Golang.
  stealer aurora
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2