General
-
Target
2af8eaa48a29c8f797e235ef1fa8f6b6.bin
-
Size
988KB
-
Sample
230328-blk2laaa7w
-
MD5
c586e7997bad1585f49d823bfc896b72
-
SHA1
9189b8f39f4840b8383275d6aac39f0561b64a74
-
SHA256
45ceec2a62289652b4cf82d221ecaf6383b2de5cbdac7db366b1a77b64e16643
-
SHA512
5cf315a93f40f99b09dfbd8455559fc1fca045c27a39e2d7e2a171b633f7f3896fa97fd53b1149856d1006f19d13b18e92de2dc8168324b0658b3c16094498fd
-
SSDEEP
24576:rcPgkj2Ch58QP/0LBKFoMx/Q4e/KLG5Cf6ukHdH1E:s7580b7xIALG5k6uS1E
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
reiv
193.233.20.33:4125
-
auth_value
5e0113277ad2cf97a9b7e175007f1c55
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd.exe
-
Size
1.0MB
-
MD5
2af8eaa48a29c8f797e235ef1fa8f6b6
-
SHA1
ed47aca3c4336827a1142412e98bb6eb6a210de3
-
SHA256
18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd
-
SHA512
e725ed99bc0b36bc2d11c3c9f0d8bf4ffa043bf77c65ccd036f27aca65440088c7774ad6d843815b709bc8a1358621053c227a2787033f3616e8abf67b580377
-
SSDEEP
24576:HyYIZh1Ln374SWDoClOJP8lZT6AirPdt0Rv3URr/T:SL1DMSIBDTB6QR/U5
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-