General
-
Target
f47bd808f90fbe4e53eaed4a71793239.bin
-
Size
682KB
-
Sample
230612-c1qfasbb9v
-
MD5
b6d7dfb286418563f4a89bbfaa0da038
-
SHA1
cb9328f73782d8ebbef0a3393faed42c25476886
-
SHA256
d2a826523bbdde4d3511eb855e50fcf1bdc16002aad273693d49dbea310d908d
-
SHA512
a95b7ea936e80b2598fa1a858885f4d37776676a9914ac0af45c8d52e855a847a236b4fb5ebfabb08ca425bb49956fc1e7b2eb4d3e218cac1701638868ce3bb1
-
SSDEEP
12288:qZvECaLiCe7NRz1OS5T4YBSU6rjvI8Dmq+Yqvr9fQlN4TsM68R5R3Cp7U:nPiCOhOOB2rLI+MJkjM68RP3Cy
Malware Config
Extracted
redline
dast
83.97.73.129:19068
-
auth_value
17d71bf1a3f93284f5848e00b0dd8222
Extracted
amadey
3.83
77.91.68.30/music/rock/index.php
Extracted
redline
crazy
83.97.73.129:19068
-
auth_value
66bc4d9682ea090eef64a299ece12fdd
Targets
-
-
Target
51d1b105b79c3c922cd4bd46524727dcb47cf694bf570d1c53626e15005108b1.exe
-
Size
726KB
-
MD5
f47bd808f90fbe4e53eaed4a71793239
-
SHA1
e86d65125e39115835b9a615a30cf820dd3d1914
-
SHA256
51d1b105b79c3c922cd4bd46524727dcb47cf694bf570d1c53626e15005108b1
-
SHA512
0cc8ee9ed4b9712738e391928ff4f427adcf61d4c6ba4010e637f3b175101d25d64b054f756a2207c09fb9d8050ba0712360e99cea730873c3b5c3b44feb6248
-
SSDEEP
12288:KMrvy90NaHstfEo9L5Ksebs6pLFfbIBX2hVYdWDfULXSr8AXD+QR:1y0L5ubbhsBX2h5DfW3W
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-