General

  • Target

    d5021f2a4d0b38054f2347c18c1ad10f68b2f8bd3019a298864a58bd564081a5

  • Size

    832KB

  • Sample

    230819-p3xcvaab27

  • MD5

    c3cc5743702f9e24b5933ca02af3ba4a

  • SHA1

    f000e460ee0c4119168c45e6aa5529de7e421959

  • SHA256

    d5021f2a4d0b38054f2347c18c1ad10f68b2f8bd3019a298864a58bd564081a5

  • SHA512

    1021f67e0b3df3a4c97d267c522d4dd7b9626f943dbd7f3db1d898a0693e456e9902fb5244805849ef9f16c39aaf8543cdce7f8b36d84eb58dc407438010275d

  • SSDEEP

    12288:TMr3y90UXcv0cQEVvIqYJD2BvMMwKCBpJWsYuIg+eCicsa7x86qalJR:kyTXhcQivIqqD0M7/BpAgnal86FR

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

jonka

C2

77.91.124.73:19071

Attributes
  • auth_value

    c95bc30cd252fa6dff2a19fd78bfab4e

Targets

    • Target

      d5021f2a4d0b38054f2347c18c1ad10f68b2f8bd3019a298864a58bd564081a5

    • Size

      832KB

    • MD5

      c3cc5743702f9e24b5933ca02af3ba4a

    • SHA1

      f000e460ee0c4119168c45e6aa5529de7e421959

    • SHA256

      d5021f2a4d0b38054f2347c18c1ad10f68b2f8bd3019a298864a58bd564081a5

    • SHA512

      1021f67e0b3df3a4c97d267c522d4dd7b9626f943dbd7f3db1d898a0693e456e9902fb5244805849ef9f16c39aaf8543cdce7f8b36d84eb58dc407438010275d

    • SSDEEP

      12288:TMr3y90UXcv0cQEVvIqYJD2BvMMwKCBpJWsYuIg+eCicsa7x86qalJR:kyTXhcQivIqqD0M7/BpAgnal86FR

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks