amadey

General

Target

8955c6d006e68b751f774d4f911bdc83ce37278517c16da93ae1bc81f5fbf85c
Size

844KB
Sample

230411-mcezrsbg79
MD5

87c5cb978a959344bb3b88232abc5e87
SHA1

5ffa8e09f7c72017ddf8721335929d4f7b6fdd36
SHA256

8955c6d006e68b751f774d4f911bdc83ce37278517c16da93ae1bc81f5fbf85c
SHA512

e7fbf594196318eec03c10d4eb7a8bacd8387bee947836cadac063bec1163130394d2bc496293cf5cb0ed69162f81f83acca9c72fded96e6e65e24e18ab1831c
SSDEEP

12288:rMrTy90qiTGcXE24herbwQCEj9u/rbgREBYZcrADaWa9SvHPqcPp5zjklE7HL0Ng:cyQEIPj9Or8iFrxYvHycPHj3HL0iomx

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

C2

176.113.115.145:4125

Attributes

auth_value
b9ed10946d21e28d58d0c72c535cde6f

Extracted

Family

amadey

Version

3.70

C2

77.91.124.207/plays/chapter/index.php

Targets

- Target
  
  8955c6d006e68b751f774d4f911bdc83ce37278517c16da93ae1bc81f5fbf85c
- Size
  
  844KB
- MD5
  
  87c5cb978a959344bb3b88232abc5e87
- SHA1
  
  5ffa8e09f7c72017ddf8721335929d4f7b6fdd36
- SHA256
  
  8955c6d006e68b751f774d4f911bdc83ce37278517c16da93ae1bc81f5fbf85c
- SHA512
  
  e7fbf594196318eec03c10d4eb7a8bacd8387bee947836cadac063bec1163130394d2bc496293cf5cb0ed69162f81f83acca9c72fded96e6e65e24e18ab1831c
- SSDEEP
  
  12288:rMrTy90qiTGcXE24herbwQCEj9u/rbgREBYZcrADaWa9SvHPqcPp5zjklE7HL0Ng:cyQEIPj9Or8iFrxYvHycPHj3HL0iomx
Score

10^/10

amadey redline nahui rosn discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1