amadey

General

Target

0a242b3fa2628ad03f7752168978e7aa.exe
Size

1.7MB
Sample

231010-e5dcmsah3s
MD5

0a242b3fa2628ad03f7752168978e7aa
SHA1

704b4b42a8b59d13f5a57d720b5798584ca5d957
SHA256

56940703a6f67b549f4c3f4e4ab7981402fa2a8ad5777c8214351dd98f2797f5
SHA512

7a0a8bac68758d5fb3fdfbebee230e11a89efb4d651da45971acbc71edea6e5cc7d074877bb2de785d5240708b4bb054cbfc2339abd14a42361d8ac87ea9cf7b
SSDEEP

49152:IUnmXxD+mSR12suCeeBmMmuJheooYF7QtthgmXN2Mo3:56+58bqmsHJmthLN2

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

frant

C2

77.91.124.55:19071

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

magia

C2

77.91.124.55:19071

Extracted

Family

redline

Botnet

lutyr

C2

77.91.124.55:19071

Extracted

Family

redline

Botnet

6012068394_99

C2

https://pastebin.com/raw/8baCJyMF

Targets

- Target
  
  0a242b3fa2628ad03f7752168978e7aa.exe
- Size
  
  1.7MB
- MD5
  
  0a242b3fa2628ad03f7752168978e7aa
- SHA1
  
  704b4b42a8b59d13f5a57d720b5798584ca5d957
- SHA256
  
  56940703a6f67b549f4c3f4e4ab7981402fa2a8ad5777c8214351dd98f2797f5
- SHA512
  
  7a0a8bac68758d5fb3fdfbebee230e11a89efb4d651da45971acbc71edea6e5cc7d074877bb2de785d5240708b4bb054cbfc2339abd14a42361d8ac87ea9cf7b
- SSDEEP
  
  49152:IUnmXxD+mSR12suCeeBmMmuJheooYF7QtthgmXN2Mo3:56+58bqmsHJmthLN2
Score

10^/10

evasion persistence trojan amadey healer mystic redline smokeloader 6012068394_99 frant lutyr magia backdoor dropper infostealer stealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2