amadey

General

Target

1274e9ba0b6023a7e0c8dc3adfb13f359fc92ae16f3a27e7492005ae66952762
Size

1.5MB
Sample

231101-sv5k2aab9t
MD5

10b57484662a18b0727d9eac8d27373b
SHA1

211578d92f6cb626b9e537facede2f46d0524e8c
SHA256

4857f24fdbab0c424d9283ca9beaa205307900c47e08117593a31db7ee665049
SHA512

10cd29fd311444836f407f8a914bf918b9b7926f91802e2058c815e0d43458964b190b38b9ad955f1d5eaf98cd09734827528b82dd93b463c0e61f80ee32465c
SSDEEP

24576:waByAMgieOvN5yOrm6kQt9kuUc93bfv2w8GhGqe/fB71Q+WlgNxplRmy:KAMgvslaKlbfv2w8o2fB71Qni7lL

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

- Target
  
  1274e9ba0b6023a7e0c8dc3adfb13f359fc92ae16f3a27e7492005ae66952762
- Size
  
  1.5MB
- MD5
  
  d246f5142bf179afcdf456f3a5b45529
- SHA1
  
  91bb8355a6294aa1977e7809bc106d43a0ce87cd
- SHA256
  
  1274e9ba0b6023a7e0c8dc3adfb13f359fc92ae16f3a27e7492005ae66952762
- SHA512
  
  71d0928f7b6c9b3b5d6de824c59900905765766b95ca2b3ad36d06c666687bc3426b9f660f6dcd51e24a582521949be93ab62dac6a2a636f57e9cbbacc8c505a
- SSDEEP
  
  24576:Ty1ugiUuvB5ygRrm6ASn9k4Uc99bvvOE8UqqOrVBbvC+wk3ghxXb1vmlC:m1ug7m/aInbvvOE8UQVBbvCvkKlb1u
Score

10^/10

amadey dcrat redline smokeloader grome backdoor paypal evasion infostealer persistence phishing rat spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral1