amadey

General

Target

9b96f1841cb639ea598416af48ce4f9f0cdc6ccb1dc0434163c40adfe32f0e1d
Size

583KB
Sample

230616-nh6kcaed8w
MD5

ed808d74c6324a7177ea39b5082ecde1
SHA1

46d8285997d22e30a76b0dee3618c486adfb6815
SHA256

9b96f1841cb639ea598416af48ce4f9f0cdc6ccb1dc0434163c40adfe32f0e1d
SHA512

5b42aa6238209be886c61274e64cfeab1610387ca882a46d4b1f2af9a7b2f5ce8f90b2025477a92b95ae9ef956448ffec5b5f1c029cf093335563e2d4cb5c35f
SSDEEP

12288:kMrYy90ueLpD1bc8YlbIWNDCYqMqGmeXidd6hx3IdcgYx:8yELb9Yl0YCYqVGmeyd4P3Uv6

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

dana

C2

83.97.73.130:19061

Attributes

auth_value
da2d1691db653e49676d799e1eae2673

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes

auth_value
a98d303cc28bb3b32a23c59214ae3bc0

Targets

- Target
  
  9b96f1841cb639ea598416af48ce4f9f0cdc6ccb1dc0434163c40adfe32f0e1d
- Size
  
  583KB
- MD5
  
  ed808d74c6324a7177ea39b5082ecde1
- SHA1
  
  46d8285997d22e30a76b0dee3618c486adfb6815
- SHA256
  
  9b96f1841cb639ea598416af48ce4f9f0cdc6ccb1dc0434163c40adfe32f0e1d
- SHA512
  
  5b42aa6238209be886c61274e64cfeab1610387ca882a46d4b1f2af9a7b2f5ce8f90b2025477a92b95ae9ef956448ffec5b5f1c029cf093335563e2d4cb5c35f
- SSDEEP
  
  12288:kMrYy90ueLpD1bc8YlbIWNDCYqMqGmeXidd6hx3IdcgYx:8yELb9Yl0YCYqVGmeyd4P3Uv6
Score

10^/10

amadey redline dana joker discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1