General
-
Target
3902a9e7e0c84e8f3554cee142e8478f.bin
-
Size
534KB
-
Sample
230613-bgq22seh3s
-
MD5
695e7f366e3ea33ae217bbf683dd024e
-
SHA1
e8722fb4b72e2a7353540ab60742a25af8f2c803
-
SHA256
4864ab9e458cd6356ef13c1b901228a71e5c72aa87958dafd31709882a211ea6
-
SHA512
07f35f64408eb3fab73edc294abb10fd992a0c9d6aaf130d035b039ca53de71c2bfeda16e1c1338bd532b4c3d6518ed89da126d66a0f07c79c8640dea69d3a5d
-
SSDEEP
12288:QFbQjJmIyvMz43NWJi3595ZuO74lLW/xKQ+i6gbA0:QqjJvy2QNp9buO+uxN+irbA0
Malware Config
Extracted
redline
dast
83.97.73.129:19068
-
auth_value
17d71bf1a3f93284f5848e00b0dd8222
Extracted
amadey
3.83
77.91.68.30/music/rock/index.php
Extracted
redline
crazy
83.97.73.129:19068
-
auth_value
66bc4d9682ea090eef64a299ece12fdd
Targets
-
-
Target
dc9800714729a51a4d877748ad4b6a689db0603e0a21b389270b02fc0afede56.exe
-
Size
578KB
-
MD5
3902a9e7e0c84e8f3554cee142e8478f
-
SHA1
5c1e9d48cef42c7655a2c197cd85bef983977498
-
SHA256
dc9800714729a51a4d877748ad4b6a689db0603e0a21b389270b02fc0afede56
-
SHA512
2445c5279c13ad0f08f93e81ab65d42b811c628c051bfecb34a7bddd574eb6c149e5098ed8b0069331ef1f09b34da968ee18a602f853958dbe93cd02b884b7aa
-
SSDEEP
12288:5Mr7y90fqfizHQWRygf6/PcuY6FTajC+qFIdkRRn:eymqfFWRyg+jTb+qOE
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-