amadey

General

Target

16c949d89e36e01e0bf33954505837913f44acda6a77bf7eca9bf87f1dc59d28
Size

1.5MB
Sample

231101-re128sdd73
MD5

42422e533e561e37e539a22a06b17df4
SHA1

4ca5762f8381b066c4cf0293fef59af7c7da33fd
SHA256

2bbd1a16984c17c8e280378e47e70f796780e8aafac12f46841247cf3d006c95
SHA512

345a4fcd91ce718b0298343d509ee80df1cd545518cdb6735e48dcf5c838400e96e08186518ffdcdb0cd44c6be41ab0e063b5e82265c45d27061bfb8494ff5e6
SSDEEP

24576:Oiyd41FQUpEce9LR/eTsSJ6RqKBLg5fyFBAsoeMlaMy3sTCmjAcjgqzRtjdzO6Gv:kd41FDicelQ7dwKf4xopg3s+4ltjdmpt

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

- Target
  
  16c949d89e36e01e0bf33954505837913f44acda6a77bf7eca9bf87f1dc59d28
- Size
  
  1.5MB
- MD5
  
  dda72babd5d8905deb16b07652f68af8
- SHA1
  
  fc5cc7db1dff1d3c995e2027e4e5419b97017d5b
- SHA256
  
  16c949d89e36e01e0bf33954505837913f44acda6a77bf7eca9bf87f1dc59d28
- SHA512
  
  f8b5d4221493101f2138fba4247c82d45889efccde2848db7253c3892f93e714b4aa4772fe2164674ba3639f43ed92c3d0d464bc7944720f1211fa1e40a466a7
- SSDEEP
  
  24576:Tyfv1Pq2PEWk9Fsg3deRqSJUFqy5LgLfyFBysoeMlOM+3yTgmJ8cjuSV1tyEwbu8:mfv1PxcWkVkRPGgf43op03y+Efty5
Score

10^/10

amadey dcrat redline smokeloader grome backdoor paypal evasion infostealer persistence phishing rat trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral1