General

  • Target

    addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b

  • Size

    1.3MB

  • Sample

    231011-k61r8afc49

  • MD5

    85a90bbf8c4498f6b6e8155c00cc1cdb

  • SHA1

    6da94e24761dbe288516a6c701232703b34ca477

  • SHA256

    addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b

  • SHA512

    f2573ccaddecd258d636ccdfd2be6b57c687cb40a829680bb6d183a854c77ad4001b8d354d090d96f5705bb64583dbe4bf9424ceec4726a015002c319919aa43

  • SSDEEP

    24576:eybS9ej9JR8BCYsZWJBY8aWVtnO8Lldi/LQLbStMb/1SR64qKsm2WRlLYtRx0:tbSmDR8B5sZsi4nO8KntCSR64/H9wR

Malware Config

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain
rc4.plain

Targets

    • Target

      addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b

    • Size

      1.3MB

    • MD5

      85a90bbf8c4498f6b6e8155c00cc1cdb

    • SHA1

      6da94e24761dbe288516a6c701232703b34ca477

    • SHA256

      addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b

    • SHA512

      f2573ccaddecd258d636ccdfd2be6b57c687cb40a829680bb6d183a854c77ad4001b8d354d090d96f5705bb64583dbe4bf9424ceec4726a015002c319919aa43

    • SSDEEP

      24576:eybS9ej9JR8BCYsZWJBY8aWVtnO8Lldi/LQLbStMb/1SR64qKsm2WRlLYtRx0:tbSmDR8B5sZsi4nO8KntCSR64/H9wR

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks