amadey

General

Target

d21c406c07d1fda60e70033a942f7c8dcc42d0cac20bd7bc88bdac330e9045e5
Size

1.5MB
Sample

231101-vymkqscg59
MD5

476610de488fff257ac4524272de0866
SHA1

a3c11e7094c0f2f3cfccbb9bb85c02c0b660c19b
SHA256

8dc9cdf493a9b846f2b6bf3426d7b864e7de5a172f4c3aef9642f8047c7e33aa
SHA512

60eba4769c8cdeb8b6e9bd6f9aee3c03d4ea98cb50611d806612e989cb50f5e4ae5679542c7a9f92debc13d9a5c2fc165fbce0406554457ebfcce5dc05f2bf30
SSDEEP

24576:J3yc6QhDybgOGIkMsIMcE8KZBOHx9m0gIGQ58WTbcflg5mHZNuJCjPoOU:UcDmbvd/McIOW0gKTwflg54yJCjPG

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

- Target
  
  d21c406c07d1fda60e70033a942f7c8dcc42d0cac20bd7bc88bdac330e9045e5
- Size
  
  1.5MB
- MD5
  
  4ec035e1cb7148d40b7e8eacaf7e3b01
- SHA1
  
  b5c116a24a912a3a2276e0636e298bc03e4e1532
- SHA256
  
  d21c406c07d1fda60e70033a942f7c8dcc42d0cac20bd7bc88bdac330e9045e5
- SHA512
  
  1122ed928bc05564d2687ca5644241678d0d0d0fb4a328e4d339fbe865ad6d6bd3dcc77c62fbe7db008fa8a922b000527dd7ed0bb693c2700d998e5bae143b25
- SSDEEP
  
  49152:hNtYGAbsX1scgBlnOueeBJYHT4fPe5oyrXe:dvYlnOZlQPepru
Score

10^/10

amadey dcrat redline smokeloader grome backdoor paypal evasion infostealer persistence phishing rat trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral1