General
-
Target
275569f4ac08042997d9941f9b8b4f74.bin
-
Size
976KB
-
Sample
230329-bgen1sfh3w
-
MD5
95f281433f3513df1c01a8a700337fbc
-
SHA1
589d39c74cc67ec196df9ea06f843f38de83c319
-
SHA256
f9a96f117bbfb68ecb00857dd9eaf448b540abee14e10741742c1b3e28b31ee7
-
SHA512
2be4d54b5b7f0592245d479a4ed2430370cf652acd23161a05124f2c7f2cd515038b9ef58c591cb2f3af9513e5b387527516f42a11657847a9ad11d6afa8b826
-
SSDEEP
24576:aygxZzRNi9ADskT28E+QGdha6tYFTuak5dSzcH3iCH68J:+Xa9/AQGdhgFU5cf8J
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
gong
193.233.20.33:4125
-
auth_value
16950897b83de3bba9e4de36f06a8c05
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
445dc1fd56eae80240c6f54b3cb1b379566c739602b5d172a890432a88fd3d57.exe
-
Size
1020KB
-
MD5
275569f4ac08042997d9941f9b8b4f74
-
SHA1
1a1861185c55572c8257f7630c6fe3a35f700dea
-
SHA256
445dc1fd56eae80240c6f54b3cb1b379566c739602b5d172a890432a88fd3d57
-
SHA512
7742fd9860b453e3fbc8d893134d36e7aa5e4f78d960425b9ac8eed35fef70a41abe30c32698ba93db2e03a10933879b9ef82631665d7fa0b643c65b8c245929
-
SSDEEP
24576:oyLrlCuGCZFxmHFcqZXTzYQSuonZcjn9ahn:vLwsWqGYtuqZEn9
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-