General

  • Target

    e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb

  • Size

    990KB

  • Sample

    231010-zagrsshe4y

  • MD5

    5df1ff21e78186054b57c4beffb97ea7

  • SHA1

    a2ed6fb4261b92a26b4d5ee97d0774afaf3d13c7

  • SHA256

    e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb

  • SHA512

    6bd15e776f4f0df8f2fb0b64d62fcabcb015891292674cc309741973027540b5e0b49ac8180d4ad5eb36417abdb93dcd6c7d0bbb082fb3042bf61f1f2f626fdd

  • SSDEEP

    24576:gyrK9ZvhdH41N89L0noCZOaEKkNDzsSEd3Sca+7Moe:nYhdmN8rCZO1KktzsSQaS

Malware Config

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain
rc4.plain

Targets

    • Target

      e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb

    • Size

      990KB

    • MD5

      5df1ff21e78186054b57c4beffb97ea7

    • SHA1

      a2ed6fb4261b92a26b4d5ee97d0774afaf3d13c7

    • SHA256

      e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb

    • SHA512

      6bd15e776f4f0df8f2fb0b64d62fcabcb015891292674cc309741973027540b5e0b49ac8180d4ad5eb36417abdb93dcd6c7d0bbb082fb3042bf61f1f2f626fdd

    • SSDEEP

      24576:gyrK9ZvhdH41N89L0noCZOaEKkNDzsSEd3Sca+7Moe:nYhdmN8rCZO1KktzsSQaS

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks