amadey

General

Target

888853269223dfc801a3ad3e3235fbc1.bin
Size

994KB
Sample

230328-cd5ayagd53
MD5

ad5ef2864217c0ec1476549afe863df4
SHA1

57135443f455d5bd69fdfa2626899f31b2fd17a0
SHA256

43693d8221d20b2b3c068b0dfcfc68dffd4968d3c1471ec84bae37e3ddbb89ec
SHA512

9ba47b535371f5e5f8caf939afd870e487d7e2f788e763210ac0c1eeca70851e6dce4912fc57eafcdd760609458b1743b7af951ca414badda064763e691ead79
SSDEEP

24576:h9R2lQhz9IDsZu4wnFkEXriEtZytJamU1URVCGgWVNDZC0z:rklEz9V2Fl+EtglU1URIGvNDo0z

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

fort

C2

193.233.20.33:4125

Attributes

auth_value
5ea5673154a804d8c80f565f7276f720

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Extracted

Family

raccoon

Botnet

301867536c206e3dae52e6d17c16cc9b

C2

http://213.226.100.108/

rc4.plain

Extracted

Family

aurora

C2

212.87.204.93:8081

Targets

- Target
  
  aa69245f1de4736bb7e95461f9dbc24212790166113bea5a3ae719d5268f3fdb.exe
- Size
  
  1.0MB
- MD5
  
  888853269223dfc801a3ad3e3235fbc1
- SHA1
  
  aefe02c01dc2503a61bf38c2bf924f3be138053d
- SHA256
  
  aa69245f1de4736bb7e95461f9dbc24212790166113bea5a3ae719d5268f3fdb
- SHA512
  
  ecae9748ede2d44be721532f64d4b528618fb192ac935f98112d530a5ea0fe7369bf4388f1d44e725cc452fa0a08e9247a67d387495a344a6108e135f03b0666
- SSDEEP
  
  24576:XyQR5waSbnqA0WXs1eaHZZbJ1GQ4h0TaoI:iQRjSbn/0cs1tX3GJAa
Score

10^/10

amadey redline fort sony discovery evasion infostealer persistence spyware stealer trojan aurora raccoon 301867536c206e3dae52e6d17c16cc9b
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Aurora
  Aurora is a crypto wallet stealer written in Golang.
  stealer aurora
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2