amadey

General

Target

9112d9e13be74dcee419e2b59c93060c16ed0d940b2ceda960ad74b7c8cd6019
Size

801KB
Sample

230616-mmh46see39
MD5

025b38398bec9b4d8d78b5466cf04aec
SHA1

9e04220560a9365847816b8c7c736852f451e208
SHA256

9112d9e13be74dcee419e2b59c93060c16ed0d940b2ceda960ad74b7c8cd6019
SHA512

ffb7697a3e9f8039d3ac4fcce28cbed674a11cfe4b4bbb23694578f707c9bf9f238583cca865c90e1c49c73be4f6a77d4f56b40ad8f4bbe54421d7049832e8b0
SSDEEP

12288:aMrsy90anL88pVXVXWRHRM8yGMFqvbNmJZzVqhy8qcb3Cdt+dkrvKsDBHUHTTf:KyFLv1yLAuERVqh1DCdtHvKIBHAf

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes

auth_value
a98d303cc28bb3b32a23c59214ae3bc0

Extracted

Family

redline

Botnet

mana

C2

83.97.73.130:19061

Attributes

auth_value
4f5139d6c845fe72d05faf05763b6c31

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

- Target
  
  9112d9e13be74dcee419e2b59c93060c16ed0d940b2ceda960ad74b7c8cd6019
- Size
  
  801KB
- MD5
  
  025b38398bec9b4d8d78b5466cf04aec
- SHA1
  
  9e04220560a9365847816b8c7c736852f451e208
- SHA256
  
  9112d9e13be74dcee419e2b59c93060c16ed0d940b2ceda960ad74b7c8cd6019
- SHA512
  
  ffb7697a3e9f8039d3ac4fcce28cbed674a11cfe4b4bbb23694578f707c9bf9f238583cca865c90e1c49c73be4f6a77d4f56b40ad8f4bbe54421d7049832e8b0
- SSDEEP
  
  12288:aMrsy90anL88pVXVXWRHRM8yGMFqvbNmJZzVqhy8qcb3Cdt+dkrvKsDBHUHTTf:KyFLv1yLAuERVqh1DCdtHvKIBHAf
Score

10^/10

amadey redline joker mana discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1