amadey | e02b10b7bcf80b4eca02dba8f28f3334699c5067d3e3d7d6ffbb435773632e2e | Triage

Sharing

General

Target

e02b10b7bcf80b4eca02dba8f28f3334699c5067d3e3d7d6ffbb435773632e2e.bin
Size

1.5MB
Sample

230505-yvt27abe84
MD5

7547f643791c72aabce2d26e98a4c88e
SHA1

063a3236ee64ff3233d2847e3ab1f65a0ac802fe
SHA256

e02b10b7bcf80b4eca02dba8f28f3334699c5067d3e3d7d6ffbb435773632e2e
SHA512

1e896e23fe45b94eba307364c34cf52c28c4afd985a74c86a6163ac6f5fc02c1b6e57da0fa47046fd00dc6f905731a62511fccfa727616b8ddcbc643b2459c95
SSDEEP

24576:lycDa27oBkT/WfSNEbEMtltcerGvWFJ5Z2qOptLFOlN5sqTcYSdzFJb:ACoBkTavb1t/0vc0qWpAlNn6zFJ

Score

10^/10

amadey redline life evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Targets

- Target
  
  e02b10b7bcf80b4eca02dba8f28f3334699c5067d3e3d7d6ffbb435773632e2e.bin
- Size
  
  1.5MB
- MD5
  
  7547f643791c72aabce2d26e98a4c88e
- SHA1
  
  063a3236ee64ff3233d2847e3ab1f65a0ac802fe
- SHA256
  
  e02b10b7bcf80b4eca02dba8f28f3334699c5067d3e3d7d6ffbb435773632e2e
- SHA512
  
  1e896e23fe45b94eba307364c34cf52c28c4afd985a74c86a6163ac6f5fc02c1b6e57da0fa47046fd00dc6f905731a62511fccfa727616b8ddcbc643b2459c95
- SSDEEP
  
  24576:lycDa27oBkT/WfSNEbEMtltcerGvWFJ5Z2qOptLFOlN5sqTcYSdzFJb:ACoBkTavb1t/0vc0qWpAlNn6zFJ
Score

10^/10

amadey redline life evasion infostealer persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeyredlinelifeevasioninfostealerpersistencetrojan

behavioral2