Overview

overview

10

Static

static

3

bf6c2427cd...9f.exe

windows7-x64

10

bf6c2427cd...9f.exe

windows10-2004-x64

10

Resubmissions

15-06-2023 16:32

230615-t135tsae65 10

12-04-2023 12:36

230412-ptcl3scc45 10

12-04-2023 12:33

230412-prmn9scc38 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf6c2427cdd1ae62e0b1e9a55ebaefca4e5e7554021343884817652808cf959f

  • Size

    1.5MB

  • Sample

    230615-t135tsae65

  • MD5

    b608a9ae94ba4680c0a4c3827d6ed5e9

  • SHA1

    09c5fc351b7df7ce3911082df265d63076a70d00

  • SHA256

    bf6c2427cdd1ae62e0b1e9a55ebaefca4e5e7554021343884817652808cf959f

  • SHA512

    e679db781c0bc11f88633d9c795701ca10cfffd0e1faba96ca7ea149ecde863b5fa30d7ee62b0c1685a524feedf2e93b00637417d14c6b3b4cbb0d440f17aa11

  • SSDEEP

    24576:4y22LmZQQXSE5VMsp0zYtKdTmRUQziSQluSOql7QexZBLVmkhAG:/2QmZQESE5/0WCTmRUNlzOqlDxJmr

Score
10/10
amadeyredlineladamaxievasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

amadey

Version

3.70

C2

193.201.9.43/plays/chapter/index.php

Extracted

Family

redline

Botnet

maxi

C2

185.161.248.90:4125

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Targets

    • Target

      bf6c2427cdd1ae62e0b1e9a55ebaefca4e5e7554021343884817652808cf959f

    • Size

      1.5MB

    • MD5

      b608a9ae94ba4680c0a4c3827d6ed5e9

    • SHA1

      09c5fc351b7df7ce3911082df265d63076a70d00

    • SHA256

      bf6c2427cdd1ae62e0b1e9a55ebaefca4e5e7554021343884817652808cf959f

    • SHA512

      e679db781c0bc11f88633d9c795701ca10cfffd0e1faba96ca7ea149ecde863b5fa30d7ee62b0c1685a524feedf2e93b00637417d14c6b3b4cbb0d440f17aa11

    • SSDEEP

      24576:4y22LmZQQXSE5VMsp0zYtKdTmRUQziSQluSOql7QexZBLVmkhAG:/2QmZQESE5/0WCTmRUNlzOqlDxJmr

    Score
    10/10
    amadeyredlineladamaxievasioninfostealerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks