amadey

General

Target

6655654f79390f56c9c286d255545ecd8d5502a483f9932ce0c49b38cbb34d44
Size

707KB
Sample

230411-l44lrsdd81
MD5

b887fc20f197dc6740538773a9054a49
SHA1

ed4e06de8abb5778027d233374dade5a1ba929d3
SHA256

6655654f79390f56c9c286d255545ecd8d5502a483f9932ce0c49b38cbb34d44
SHA512

ab6a275edf6ba07d02f61bc67088d8f128a30549b3fae9257b0a7e3deba3422874c3f11424d0f62109f08f9234ab77cc0bc5465ae24a0b097aeb59d2621fbaf8
SSDEEP

12288:YMrGEy90CSHYmGkFHN6aa0iiGpfDIUreA3PzyP1HI7ttKG4pc3ofxsWkUn5WBl2y:hy9S4z+N6aaUGpfD/eA3Pzy9HI7OGh3X

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

C2

176.113.115.145:4125

Attributes

auth_value
b9ed10946d21e28d58d0c72c535cde6f

Extracted

Family

amadey

Version

3.70

C2

77.91.124.207/plays/chapter/index.php

Targets

- Target
  
  6655654f79390f56c9c286d255545ecd8d5502a483f9932ce0c49b38cbb34d44
- Size
  
  707KB
- MD5
  
  b887fc20f197dc6740538773a9054a49
- SHA1
  
  ed4e06de8abb5778027d233374dade5a1ba929d3
- SHA256
  
  6655654f79390f56c9c286d255545ecd8d5502a483f9932ce0c49b38cbb34d44
- SHA512
  
  ab6a275edf6ba07d02f61bc67088d8f128a30549b3fae9257b0a7e3deba3422874c3f11424d0f62109f08f9234ab77cc0bc5465ae24a0b097aeb59d2621fbaf8
- SSDEEP
  
  12288:YMrGEy90CSHYmGkFHN6aa0iiGpfDIUreA3PzyP1HI7ttKG4pc3ofxsWkUn5WBl2y:hy9S4z+N6aaUGpfD/eA3Pzy9HI7OGh3X
Score

10^/10

amadey redline nahui rosn discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1