Overview

overview

10

Static

static

3

file.exe

windows7-x64

7

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    2.2MB

  • Sample

    240105-p2sy2accfn

  • MD5

    7a13263bcdc6ec934152d2ae80c5eb91

  • SHA1

    c4834ac28e1e373d747f5a822037fedc973cfb70

  • SHA256

    3e0159326f354109d2b468ead12982d5d33d6d5936081eb59903965b995bad22

  • SHA512

    69187b2807011b0a0d789cbe03c289914593c97fb636e78e90ed2ddeba039275deb9062e3b7ca1fb08127888149f0d1c3f4c7096952944281ed76ab9a40ec118

  • SSDEEP

    49152:iIVsfros222h76y5gY+gkasdRiwN4W7POaM4gl6jfPru8Okk:xVpsQ155gY+Ysdcw4UPnI0fPK8Ot

Score
10/10
amadeyredline@pixelivelegaalivetraficinfostealerpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

4.15

C2

http://185.215.113.68

Attributes
  • install_dir

    d887ceb89d

  • install_file

    explorhe.exe

  • strings_key

    7cadc181267fafff9df8503e730d60e1

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTrafic

C2

20.79.30.95:13856

Extracted

Family

redline

Botnet

@Pixelive

C2

195.20.16.103:20440

Extracted

Family

redline

Botnet

Legaa

C2

185.172.128.33:38294

Targets

    • Target

      file

    • Size

      2.2MB

    • MD5

      7a13263bcdc6ec934152d2ae80c5eb91

    • SHA1

      c4834ac28e1e373d747f5a822037fedc973cfb70

    • SHA256

      3e0159326f354109d2b468ead12982d5d33d6d5936081eb59903965b995bad22

    • SHA512

      69187b2807011b0a0d789cbe03c289914593c97fb636e78e90ed2ddeba039275deb9062e3b7ca1fb08127888149f0d1c3f4c7096952944281ed76ab9a40ec118

    • SSDEEP

      49152:iIVsfros222h76y5gY+gkasdRiwN4W7POaM4gl6jfPru8Okk:xVpsQ155gY+Ysdcw4UPnI0fPK8Ot

    Score
    10/10
    persistenceamadeyredline@pixelivelegaalivetraficinfostealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks