amadey

General

Target

send.zip
Size

90KB
Sample

230505-b6968ahh3x
MD5

6eb42d220f60c076f7accd00e99dff7c
SHA1

8d04ef21f9d4328b4e1bb32c0bc9f9ec6bd529e0
SHA256

0a4eae79f85d762c9c0d0afda7ad0accf4528e8ef31d0b4157dd286b99ae6f6f
SHA512

362552922c74d9e983ca5e167c0744e03704ab77047047fe761294684a641295a9c8067831c387a56cf5c748df0a91990fa4427bafbfc5799c37a2b5cc564e02
SSDEEP

1536:1nNcI+GXzclcooN9rbtfN/4BpMarESjHgU6FV6AGQeqYHI58u8sl7H5:1nWI+mzecooN9tfNQTM/iAUGN/nYH68G

Score

10^/10

Malware Config

Extracted

Family

redline

C2

135.181.11.39:33468

Attributes

auth_value
8371c94cfa5b9230afb9ccb73536d331

Extracted

Family

remcos

Botnet

dream

C2

report1.duckdns.org:3380

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-3IC60X
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

aurora

C2

94.142.138.215:8081

Targets

- Target
  
  a.exe
- Size
  
  5KB
- MD5
  
  e85d1bf9541e208169c02ae367c3a483
- SHA1
  
  adf5ba9458aec68633f154990dde8dbd7727f999
- SHA256
  
  f6dea983f6b6724da33e751a66857ae242e8a948aa4b3c8512416df203e3dbc9
- SHA512
  
  8c272c18bed6248c85ef86bddb53f3d2a842100197a8d0ce147f19c9af5775ac27da6a9ab98ce0357ed17fa86a133ec59aac8fd7adf94796251e274e2a797b9c
- SSDEEP
  
  96:+jfXEXA5ROFruevXvAADDxtMkY6pOssvNzNt:ifkTrXvbTMkY2OHn
Score

10^/10

amadey aurora redline remcos dream evasion infostealer persistence rat stealer trojan gh0strat sectoprat xmrig miner
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Aurora
  Aurora is a crypto wallet stealer written in Golang.
  stealer aurora
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- XMRig Miner payload
  miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Downloads MZ/PE file
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  s.txt
- Size
  
  285KB
- MD5
  
  adc66e72450361ce494c2d3380670ff9
- SHA1
  
  467484750d09ec66fc17686b10deb57bfa23a423
- SHA256
  
  113a87ec1be61059a3b13f9ccb43ea18d5ca644949ad8f6d6d5e4056aa33cebc
- SHA512
  
  309a98e95471f4159cd7a4cf7714c72eba3b8dda48bdac7aaf19d2ccf0efc2945e90daf430c6f007573e074408dafc7e07b00929fba6b073ca7480b69b3fff95
- SSDEEP
  
  6144:arXHD4stFNh097hUwg9/1MHwgxxNg7p89bLY9YocTckbd7oY+3gLC4rbyyt9/N/F:arXHdNh097hUwg9/1MHwgxxNg7p89bL9
Score

1^/10
behavioral3 behavioral4