amadey

General

Target

221dd954d9bfbc1f41f5b30953401453.bin
Size

1.3MB
Sample

230912-bg7pssch28
MD5

7827ede857db134c22c308ca4f6a8d6e
SHA1

83113993ed0511647c714fd6c816df1af84ef4c1
SHA256

78a107d36c9e26df008444e3ac01271623b4ba632dc163d11c7c4cdaf5703896
SHA512

984756af5018f8aa3e53d38c9292c523516a59af97aafe5a0579f6a67dda85b606c4a82cff6dd8d3ef20a96016bbf337f4d5984245604a7a80b164ba4d991f4b
SSDEEP

24576:eg3FRG1Xpsijj6rAMn0B2mtQgZSfUToMaspueo4Yqi6lYTLZxHn/FN6MC:eAnG1HerAMoAMayo4Yq1liLZxHnKMC

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

smokiez_build

C2

194.169.175.232:45450

Attributes

auth_value
2e68bc276986767f0f14a3d75567abcd

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

tuco

C2

77.91.124.82:19071

Attributes

auth_value
dcfeb759bae9232de006fc3a4b34ac53

Extracted

Family

amadey

Version

3.83

C2

http://5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Extracted

Family

redline

Botnet

220022

C2

142.132.181.20:31080

Attributes

auth_value
361b1436ad4c89a1bfe46e849cecc518

Targets

- Target
  
  b1e2a3c398285245e9f23bcc6ed924620c76a703f6403495e29fd13df598131a.exe
- Size
  
  1.5MB
- MD5
  
  221dd954d9bfbc1f41f5b30953401453
- SHA1
  
  d870cde7bd9c2da0c73483cc958b70df82cdea9d
- SHA256
  
  b1e2a3c398285245e9f23bcc6ed924620c76a703f6403495e29fd13df598131a
- SHA512
  
  440e23530777f77e7af2849194d948eb728ff45c86669b6f0e0ae952773e41279d5c1df2c0194a9788edd2e2893cbd68b485522fb00efcafe41d49f66786c6ef
- SSDEEP
  
  24576:KIzCJKSWDErfNqTYwuHrxLAKZQJneWkARgD51kbAw2arTMHnGXgu1Hg:TzCJKg7NqTqHdLAT9eWLRgnk51XsnGN6
Score

10^/10

amadey healer redline smokeloader 220022 smokiez_build tuco backdoor discovery dropper evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2