amadey | e59600bb3740fc08a67b8a3f05353f32c78e557c3759b26b5b552f186e96e61a | Triage

Sharing

General

Target

e59600bb3740fc08a67b8a3f05353f32c78e557c3759b26b5b552f186e96e61a
Size

490KB
Sample

230507-mj5trsec93
MD5

05b49a0f74c155772de3b78bf805b75d
SHA1

19b3aa205a4a6eb3156ccafdbb78fcce2a065d2a
SHA256

e59600bb3740fc08a67b8a3f05353f32c78e557c3759b26b5b552f186e96e61a
SHA512

2cbdd5a9e9505c0bec020070d21c42e0ef934e08b4e7115d53a2fdf6db549cfd8de133bd3a6bb836b83b107f47a7ddb33f99bc50c68609daeb467fc00ac00219
SSDEEP

12288:2MrMy90ee6oMkl/oMJZL0dzVH3gnepaLqf2XQwQsb:WyTeX/NyxieOqeAG

Score

10^/10

amadey redline lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

C2

217.196.96.101:4132

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

- Target
  
  e59600bb3740fc08a67b8a3f05353f32c78e557c3759b26b5b552f186e96e61a
- Size
  
  490KB
- MD5
  
  05b49a0f74c155772de3b78bf805b75d
- SHA1
  
  19b3aa205a4a6eb3156ccafdbb78fcce2a065d2a
- SHA256
  
  e59600bb3740fc08a67b8a3f05353f32c78e557c3759b26b5b552f186e96e61a
- SHA512
  
  2cbdd5a9e9505c0bec020070d21c42e0ef934e08b4e7115d53a2fdf6db549cfd8de133bd3a6bb836b83b107f47a7ddb33f99bc50c68609daeb467fc00ac00219
- SSDEEP
  
  12288:2MrMy90ee6oMkl/oMJZL0dzVH3gnepaLqf2XQwQsb:WyTeX/NyxieOqeAG
Score

10^/10

amadey redline lada discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

amadeyredlineladadiscoveryevasioninfostealerpersistencespywarestealertrojan