amadey

General

Target

3bf5f77885530c0d43bb30d3d4661102839db08ab96a257c9df30a59b635d405
Size

1.2MB
Sample

230414-kp6xxahc27
MD5

aca7f8642a66f5ee25118026170f0e09
SHA1

6eac8fd3eedbb65d7b5b5b6d906cd5ff462df18d
SHA256

3bf5f77885530c0d43bb30d3d4661102839db08ab96a257c9df30a59b635d405
SHA512

666a622037ca7139407b9540c3a9c690cfc6a266d5a92fcbeb187eb8eb6d842efe1bc436b20f10716bed749c80ca50caa50d988ba6461016df30dc78216dba57
SSDEEP

24576:Mysjdv4t0MiT4c5wCak5NkPjVr1j9Nuj+K3ZLcxafuupGuVyi:7sjdv9VGkejVr1h8yqZ4xa24GI

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes

auth_value
93f8c4ca7000e3381dd4b6b86434de05

Targets

- Target
  
  3bf5f77885530c0d43bb30d3d4661102839db08ab96a257c9df30a59b635d405
- Size
  
  1.2MB
- MD5
  
  aca7f8642a66f5ee25118026170f0e09
- SHA1
  
  6eac8fd3eedbb65d7b5b5b6d906cd5ff462df18d
- SHA256
  
  3bf5f77885530c0d43bb30d3d4661102839db08ab96a257c9df30a59b635d405
- SHA512
  
  666a622037ca7139407b9540c3a9c690cfc6a266d5a92fcbeb187eb8eb6d842efe1bc436b20f10716bed749c80ca50caa50d988ba6461016df30dc78216dba57
- SSDEEP
  
  24576:Mysjdv4t0MiT4c5wCak5NkPjVr1j9Nuj+K3ZLcxafuupGuVyi:7sjdv9VGkejVr1h8yqZ4xa24GI
Score

10^/10

amadey redline disa lada discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1