Overview

overview

10

Static

static

10

0x00320000...58.exe

windows7-x64

10

0x00320000...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x0032000000015e09-358.dat

  • Size

    426KB

  • Sample

    240104-zrhenabedj

  • MD5

    9a0b7ee713610b8395c8f0580a3b1e3d

  • SHA1

    e44a9e7ec6fe06ae6ba1b9518db78e95ad451942

  • SHA256

    6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357

  • SHA512

    0f7acbc99ef4b91eba1db5b50a352f29432da25bbd3c4364947dad3d1ce2ccc3b9f95f75e66a22cd11d7fcd8bfcc6903ba646b2e8543767bce4b6b786736f8fc

  • SSDEEP

    6144:1OP1cLnbZQOvBM1nGT7SVJEeFRuhuRlOBC+3hmHfqYr5PcfT5m0JuGeFxACt70+N:cPkOOKGNeZ6C+RpYrtS5m0JuGeFxZ06

Score
10/10
amadeyredlinezgratlivetraficinfostealerrattrojan

Malware Config

Extracted

Family

amadey

C2

http://185.215.113.68

Attributes
  • strings_key

    7cadc181267fafff9df8503e730d60e1

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

amadey

Version

4.15

C2

http://185.215.113.68

Attributes
  • install_dir

    d887ceb89d

  • install_file

    explorhe.exe

  • strings_key

    7cadc181267fafff9df8503e730d60e1

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTrafic

C2

20.79.30.95:13856

Targets

    • Target

      0x0032000000015e09-358.dat

    • Size

      426KB

    • MD5

      9a0b7ee713610b8395c8f0580a3b1e3d

    • SHA1

      e44a9e7ec6fe06ae6ba1b9518db78e95ad451942

    • SHA256

      6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357

    • SHA512

      0f7acbc99ef4b91eba1db5b50a352f29432da25bbd3c4364947dad3d1ce2ccc3b9f95f75e66a22cd11d7fcd8bfcc6903ba646b2e8543767bce4b6b786736f8fc

    • SSDEEP

      6144:1OP1cLnbZQOvBM1nGT7SVJEeFRuhuRlOBC+3hmHfqYr5PcfT5m0JuGeFxACt70+N:cPkOOKGNeZ6C+RpYrtS5m0JuGeFxZ06

    Score
    10/10
    amadeyredlinezgratlivetraficinfostealerrattrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks