amadey

General

Target

5ab493e8263fdc603cd5d6379781370c.bin
Size

986KB
Sample

230328-byrpxaab5v
MD5

bf8365fed6741d602faffe400b1a4610
SHA1

9cc383bcd07da1d470bfcda3e3ceef61325cfa73
SHA256

10f8fdb6c418db38657f0555e7f849b06669ad006ea3c57d25a48dd14eabee6b
SHA512

20a9def41930265d2f94e10cf3b04d5938f326b320f5c679435bfb39c99615b3042e0c6fa5ea16da4e46aa6f0d460cb3cb6016b8f7df5f37ef8ad686b9df878f
SSDEEP

24576:Z8orJkGC5kzDsjFo8ych3qwFPSRKYaNWw8Aoa87oUX:Z8o1oiHkyAqwiFFsUX

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

fort

C2

193.233.20.33:4125

Attributes

auth_value
5ea5673154a804d8c80f565f7276f720

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Extracted

Family

raccoon

Botnet

301867536c206e3dae52e6d17c16cc9b

C2

http://213.226.100.108/

rc4.plain

Extracted

Family

aurora

C2

212.87.204.93:8081

Targets

- Target
  
  cf031c6da544366c478a769a2a11743e07e6081891344ed83a3e0ab2a96f2343.exe
- Size
  
  1.0MB
- MD5
  
  5ab493e8263fdc603cd5d6379781370c
- SHA1
  
  92e0ff46ecd086e0e030e9ccb0d9b12a5b0716b4
- SHA256
  
  cf031c6da544366c478a769a2a11743e07e6081891344ed83a3e0ab2a96f2343
- SHA512
  
  eb3faa8f0129453676b637739b3b4813ea6975bf88bf1c566588c8250aac67a50163a921482d0b5491df19b8e4a78bffd5c1e1ee9d64c73152c165cbfb6d933f
- SSDEEP
  
  12288:/Mrjy90Pqd4U96S5aY50+IprbrXcGhJb3pJmaiqorbP0XHG4ioCk88AVKMCT6C:gybdfDg+INrxhhHmdrbP4mDoJANu3
Score

10^/10

amadey redline fort sony discovery evasion infostealer persistence spyware stealer trojan aurora raccoon 301867536c206e3dae52e6d17c16cc9b
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Aurora
  Aurora is a crypto wallet stealer written in Golang.
  stealer aurora
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2