amadey | 307fc7edc0054a9ae8149641a8ae9c4767b2ecc2ba22e7e966ebd14772f776d8 | Triage

Sharing

General

Target

07941099.exe
Size

736KB
Sample

230623-jg3pvadb78
MD5

4875bbb4da8ac597c5af153471225b45
SHA1

ae602d908e0cb1c94663ae2d41970298bd0f94a0
SHA256

307fc7edc0054a9ae8149641a8ae9c4767b2ecc2ba22e7e966ebd14772f776d8
SHA512

402e84bdda2d42e528e23fa9382ebbfbfb65ebde763682c45f1f1e4522ff76e7ec13a90d737b9fc728c7614a4d7d7d88f803f06637fc55b46cbe948ea4536e4f
SSDEEP

12288:6NvqURiAU0V6hwAphMWHxznz3Z0FsDMbFh1vuAltgkDoYqtu3ZsI:6QEU0GhzZAuCbk5u3S

Score

10^/10

amadey redline furga discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

furga

C2

83.97.73.128:19071

Attributes

auth_value
1b7af6db7a79a3475798fcf494818be7

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

- Target
  
  07941099.exe
- Size
  
  736KB
- MD5
  
  4875bbb4da8ac597c5af153471225b45
- SHA1
  
  ae602d908e0cb1c94663ae2d41970298bd0f94a0
- SHA256
  
  307fc7edc0054a9ae8149641a8ae9c4767b2ecc2ba22e7e966ebd14772f776d8
- SHA512
  
  402e84bdda2d42e528e23fa9382ebbfbfb65ebde763682c45f1f1e4522ff76e7ec13a90d737b9fc728c7614a4d7d7d88f803f06637fc55b46cbe948ea4536e4f
- SSDEEP
  
  12288:6NvqURiAU0V6hwAphMWHxznz3Z0FsDMbFh1vuAltgkDoYqtu3ZsI:6QEU0GhzZAuCbk5u3S
Score

10^/10

amadey redline furga discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeyredlinefurgadiscoveryevasioninfostealerpersistencespywarestealertrojan

behavioral2

amadeyredlinefurgadiscoveryevasioninfostealerpersistencespywarestealertrojan