amadey

Sharing

General

Target

2535f8cb82709b30fc6869167bc53d51.bin
Size

1.2MB
Sample

230912-blbg6acd4w
MD5

ea80a46ed8d6b7e396c07900f4f010cb
SHA1

39b733a5fdfd1df422462f46e0186e42b56f3f96
SHA256

144c903a9059934812252fe04a91896109119c4532c520521ba837c893682197
SHA512

ec909de0b165723c9a6a5137f84abee9260bc81895776dfd51f9b728fb130f82b6d5b06126a4a74984a84306eb7719cf66817157aeb76cc57cfd32ef2eb17552
SSDEEP

24576:AO82Lalv4vpJZ5xY4maEE1aeSx0NmDg2IunjWYt7sgw+R95b0P0/:X82LWvIpHC3/xwmDg2rKWsg3w0/

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Extracted

Family

redline

Botnet

tuco

77.91.124.82:19071

Attributes

auth_value
dcfeb759bae9232de006fc3a4b34ac53

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

Invoice

147.124.213.118:50826

Extracted

Family

redline

Botnet

220022

142.132.181.20:31080

Attributes

auth_value
361b1436ad4c89a1bfe46e849cecc518

Extracted

Family

amadey

Version

3.83

http://5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Targets

- Target
  
  c3de8f808b7c5b3b37549bb8b6bea11463eed6a74532797f9a4214c1b5ea747f.exe
- Size
  
  1.4MB
- MD5
  
  2535f8cb82709b30fc6869167bc53d51
- SHA1
  
  f55c2b4694af43ebcaa26cf55b7347748cf11a41
- SHA256
  
  c3de8f808b7c5b3b37549bb8b6bea11463eed6a74532797f9a4214c1b5ea747f
- SHA512
  
  e02b06234324e704cbf57dbb5cab18ef8336d2e7b177fae35e23f0528335b29dbf1f7211f06f36eba6f6fa9e9765db9516bb31a23c840945f6e54b95ff297404
- SSDEEP
  
  24576:lwnCWu1Nf1tVl3Nq4I8zryaxejICXOlAR77M7sTiALgBKUL4eKbCOJR1:6nCWuff1tLkSzrIjLm47YIPLbHXbCOJr
Score

10^/10

amadey healer redline sectoprat smokeloader 220022 invoice tuco backdoor discovery dropper evasion infostealer persistence rat spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2