General

  • Target

    https://telegra.ph/Description-02-12

  • Sample

    230522-rq482aha52

Malware Config

Extracted

Family

amadey

Version

3.69

C2

77.91.78.118/u83mfdS2/index.php

Extracted

Family

redline

C2

135.181.10.136:4328

Attributes
  • auth_value

    a909e2aaecf96137978fea4f86400b9b

Targets

    • Target

      https://telegra.ph/Description-02-12

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks