Overview

overview

10

Static

static

3

a4b82f9195...c9.exe

windows7-x64

10

a4b82f9195...c9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2b1c29935851f07ebd3feaa052b544a.bin

  • Size

    1.0MB

  • Sample

    231011-jdgm7shh5y

  • MD5

    57ed0a3e9581fa788847eab9ac4d651a

  • SHA1

    f9b8d1cecc6a4db0184e8a6942bc7521ff2e0034

  • SHA256

    9dba2271cbbe9b123c642e6a418c1c68afa4b5b02ace845743e7edcee73f8404

  • SHA512

    530b08c4f4d0190ccb7106e0c8591373b28ae766dd14446006a53506ae3129e49057a172a5635bdadd253c41501a53b08accbb1e82ba3505c085c8067517b877

  • SSDEEP

    24576:LybUNqutotww6k0iEGXbgzapw9A3pVgJMika68IM:aUN3Kt48X0zgrHgyib68p

Score
10/10
amadeyhealermysticredlinegruhadropperevasioninfostealerpersistencestealertrojan

Malware Config

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php
Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain
rc4.plain

Targets

    • Target

      a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9.exe

    • Size

      1.0MB

    • MD5

      b2b1c29935851f07ebd3feaa052b544a

    • SHA1

      f8ca761b11bb1649db852b3f472a4c68a236dea4

    • SHA256

      a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9

    • SHA512

      b42bf627ceeb6531bad47bdaedaabc2e0da3381a71da1be82552ec199b11cc9856925bd270201be25d180554694b37c0382c41803f4fbb9cd84cc7c1d7def17a

    • SSDEEP

      24576:4yRwCOkAte0CNeFLRHbCWxfcIFDS51iOr2w:/RVOkA6Ned1uIFKfr

    Score
    10/10
    healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks