amadey

General

Target

8c4fe1c37205b6f8f5799725a31ca52b312987d4b729a8e5231a0ef64dfff2c3
Size

1023KB
Sample

230421-q6747ahg5t
MD5

f27585b4f3c1c6ad074f120b5f287439
SHA1

c6169d60094e3f1864676362290625a2e48fc848
SHA256

8c4fe1c37205b6f8f5799725a31ca52b312987d4b729a8e5231a0ef64dfff2c3
SHA512

6558b6f4e8545fc006f1273ff8221401f505242c69df0462821e1d7f5800ffdeece1475be1ba9230f4088b1cf69ffa9f7cf58fa6aedf549b354ca99625cb745c
SSDEEP

24576:/yic5Zp8ZK0fndUnsHFmzi76SmfVqvo9c/bhr21k:KigmTfndUnsQzqyEwO/tK1

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

redline

Botnet

special

C2

176.123.9.142:14845

Attributes

auth_value
bb28ee957fad348ef1dfce97134849bc

Extracted

Family

redline

Botnet

cheat

C2

62.108.37.195:16060

Targets

- Target
  
  8c4fe1c37205b6f8f5799725a31ca52b312987d4b729a8e5231a0ef64dfff2c3
- Size
  
  1023KB
- MD5
  
  f27585b4f3c1c6ad074f120b5f287439
- SHA1
  
  c6169d60094e3f1864676362290625a2e48fc848
- SHA256
  
  8c4fe1c37205b6f8f5799725a31ca52b312987d4b729a8e5231a0ef64dfff2c3
- SHA512
  
  6558b6f4e8545fc006f1273ff8221401f505242c69df0462821e1d7f5800ffdeece1475be1ba9230f4088b1cf69ffa9f7cf58fa6aedf549b354ca99625cb745c
- SSDEEP
  
  24576:/yic5Zp8ZK0fndUnsHFmzi76SmfVqvo9c/bhr21k:KigmTfndUnsQzqyEwO/tK1
Score

10^/10

amadey laplas redline sectoprat cheat special clipper discovery evasion infostealer persistence rat spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Laplas Clipper
  Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
  stealer clipper laplas
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1