amadey | c64924922bcb56e1bd682f274a70e5d6c7800661131d65a481cbfb8538e08daa | Triage

Sharing

General

Target

c64924922bcb56e1bd682f274a70e5d6c7800661131d65a481cbfb8538e08daa.bin
Size

1.2MB
Sample

230505-x8kj8she38
MD5

3b3798695f27d6478ad25351d1c9aeff
SHA1

b0d9bfbe1ade0f3bee7a014d32eb010d2f62f65b
SHA256

c64924922bcb56e1bd682f274a70e5d6c7800661131d65a481cbfb8538e08daa
SHA512

3d54ec9478b323b6e7e45d9c4bdef7f33c0948a7539d325d970ed193b8228c6462f200ff9b08104a394537f048facb1fc90254e2bb70c5328c9997eb0f4ff240
SSDEEP

24576:gyunj56eMwAnADn+tJ9ZMI+1vex8ds5W0AOPySj:nujrMdq+tJzIkMuWPOb

Score

10^/10

amadey redline gena life evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Targets

- Target
  
  c64924922bcb56e1bd682f274a70e5d6c7800661131d65a481cbfb8538e08daa.bin
- Size
  
  1.2MB
- MD5
  
  3b3798695f27d6478ad25351d1c9aeff
- SHA1
  
  b0d9bfbe1ade0f3bee7a014d32eb010d2f62f65b
- SHA256
  
  c64924922bcb56e1bd682f274a70e5d6c7800661131d65a481cbfb8538e08daa
- SHA512
  
  3d54ec9478b323b6e7e45d9c4bdef7f33c0948a7539d325d970ed193b8228c6462f200ff9b08104a394537f048facb1fc90254e2bb70c5328c9997eb0f4ff240
- SSDEEP
  
  24576:gyunj56eMwAnADn+tJ9ZMI+1vex8ds5W0AOPySj:nujrMdq+tJzIkMuWPOb
Score

10^/10

amadey redline gena life evasion infostealer persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeyredlinegenalifeevasioninfostealerpersistencetrojan

behavioral2

evasionpersistencetrojan