amadey

General

Target

tmp
Size

4.0MB
Sample

231029-nr6lpsfe91
MD5

229df5fd5f850d26bb0b0a05f0918e9a
SHA1

400871984e6d833956f06734d7be5d8b7c8cb997
SHA256

4b9d1edaea936f67387f42846014802d768ee548af10116d09c2ae253a61cdbd
SHA512

1d1f829572daa2a90311f3db455970043a95928c10bad066b51af2aef24d1e72fbe45cbecb61d682414c0d511d104af93826f594f627474c7dd1d142bd306756
SSDEEP

98304:dCUPT4Mzeh+6D6UH+phuRO5bezZvSZ0NOk/Lg8eSjD:dCwe4O7H45bezZvIaOk/LgbSjD

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.80

C2

http://45.15.156.208/jd9dd3Vw/index.php

http://second.amadgood.com/jd9dd3Vw/index.php

Attributes

install_dir
eb0f58bce7
install_file
oneetx.exe
strings_key
2b74c848ebcfe9bcac3cd4aec559934c

rc4.plain

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes

api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Targets

- Target
  
  tmp
- Size
  
  4.0MB
- MD5
  
  229df5fd5f850d26bb0b0a05f0918e9a
- SHA1
  
  400871984e6d833956f06734d7be5d8b7c8cb997
- SHA256
  
  4b9d1edaea936f67387f42846014802d768ee548af10116d09c2ae253a61cdbd
- SHA512
  
  1d1f829572daa2a90311f3db455970043a95928c10bad066b51af2aef24d1e72fbe45cbecb61d682414c0d511d104af93826f594f627474c7dd1d142bd306756
- SSDEEP
  
  98304:dCUPT4Mzeh+6D6UH+phuRO5bezZvSZ0NOk/Lg8eSjD:dCwe4O7H45bezZvIaOk/LgbSjD
Score

10^/10

amadey laplas redline clipper evasion infostealer stealer trojan vmprotect
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Laplas Clipper
  Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
  stealer clipper laplas
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2