amadey | eff00716122cee5bf3f88fa76d005f9333c47445c47959be08ef043b0189383e | Triage

Sharing

General

Target

eff00716122cee5bf3f88fa76d005f9333c47445c47959be08ef043b0189383e
Size

1.0MB
Sample

230414-kbvbyshb57
MD5

05e6c2fc61c94287a4220b4986ec67d6
SHA1

45be9b4f2291af8b0d15555f052e628769fa8a29
SHA256

eff00716122cee5bf3f88fa76d005f9333c47445c47959be08ef043b0189383e
SHA512

3bec9a24249ff7d5e9d68a845324365054ce6542a8429f20f139be2180fbcdf568371e6b21367597812d034780b427137d5820dfca9206cd580a8304f0d555a0
SSDEEP

24576:VyG1xMrtyxQqlKfH149MQSMDL3LgGqcnmN:wI8pqYfH1MD3Hdqcm

Score

10^/10

amadey redline disa lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes

auth_value
93f8c4ca7000e3381dd4b6b86434de05

Targets

- Target
  
  eff00716122cee5bf3f88fa76d005f9333c47445c47959be08ef043b0189383e
- Size
  
  1.0MB
- MD5
  
  05e6c2fc61c94287a4220b4986ec67d6
- SHA1
  
  45be9b4f2291af8b0d15555f052e628769fa8a29
- SHA256
  
  eff00716122cee5bf3f88fa76d005f9333c47445c47959be08ef043b0189383e
- SHA512
  
  3bec9a24249ff7d5e9d68a845324365054ce6542a8429f20f139be2180fbcdf568371e6b21367597812d034780b427137d5820dfca9206cd580a8304f0d555a0
- SSDEEP
  
  24576:VyG1xMrtyxQqlKfH149MQSMDL3LgGqcnmN:wI8pqYfH1MD3Hdqcm
Score

10^/10

amadey redline disa lada discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan