amadey

General

Target

e0b8a0afe4855e59d8057471e8dd49eca154ec80f91d478a178a8a7c0c94bf61
Size

1.1MB
Sample

230409-q3nw5sda8x
MD5

70f1d3520f7229d9442d9990c458e666
SHA1

d22474aa208521beeecb4bc1517cc241b643df71
SHA256

e0b8a0afe4855e59d8057471e8dd49eca154ec80f91d478a178a8a7c0c94bf61
SHA512

5433f22fd5e0d2cf9176ac952be96c1272565b068dbbbfcbf504dbea56e499c7f5271a9368512116842ed3fb404d9194fe90681c14191a77dce817a1c252a99b
SSDEEP

24576:qyOUiR6D9qkvTOw9QIZQA9Ndc7WZQIIGq8vusukdatYdxLvQ8Mhn5ElNTt:xOUimTOwWYR9NdsWZ4GqNsukMM1QF5EX

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

lenox

C2

77.91.124.145:4125

Attributes

auth_value
a5c9c17a250a084c5fd706c1df7c2d4e

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

- Target
  
  e0b8a0afe4855e59d8057471e8dd49eca154ec80f91d478a178a8a7c0c94bf61
- Size
  
  1.1MB
- MD5
  
  70f1d3520f7229d9442d9990c458e666
- SHA1
  
  d22474aa208521beeecb4bc1517cc241b643df71
- SHA256
  
  e0b8a0afe4855e59d8057471e8dd49eca154ec80f91d478a178a8a7c0c94bf61
- SHA512
  
  5433f22fd5e0d2cf9176ac952be96c1272565b068dbbbfcbf504dbea56e499c7f5271a9368512116842ed3fb404d9194fe90681c14191a77dce817a1c252a99b
- SSDEEP
  
  24576:qyOUiR6D9qkvTOw9QIZQA9Ndc7WZQIIGq8vusukdatYdxLvQ8Mhn5ElNTt:xOUimTOwWYR9NdsWZ4GqNsukMM1QF5EX
Score

10^/10

amadey redline lenox norm discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1