amadey

General

Target

amer.exe_fa28eef0849acaf3e0fecf455938bdbf26282afcc3d89eb491cafbf0aed5331b
Size

791KB
Sample

240123-ct9klaehhn
MD5

6878df738defcf088ba56b4d214ca1bd
SHA1

24a27c8c1d8a248dc76f060d7ab1cbfe5bf257a2
SHA256

fa28eef0849acaf3e0fecf455938bdbf26282afcc3d89eb491cafbf0aed5331b
SHA512

7b047edb4c5bd01d4eaa7062fd60453cb0093a80e8a3f9e62703b67fd4c78f06e04005e31dc4d6df4b39409efc730e327de4a871d109ef78a9b28dbd69ae4b78
SSDEEP

24576:UvNgtcwqLlnUwQeRHW/nSJVuPR4CZbmNrUJqh:UFVw4lnUleR2/SvoZSgE

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.15

C2

http://185.215.113.68

Attributes

install_dir
d887ceb89d
install_file
explorhe.exe
strings_key
7cadc181267fafff9df8503e730d60e1
url_paths
/theme/index.php

rc4.plain

Extracted

Family

risepro

C2

193.233.132.62:50500

Extracted

Family

redline

Botnet

@Pixelscloud

C2

94.156.66.203:13781

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.113.35.45:38357

Extracted

Family

redline

Botnet

@RLREBORN Cloud TG: @FATHEROFCARDERS)

C2

141.95.211.148:46011

Targets

- Target
  
  amer.exe_fa28eef0849acaf3e0fecf455938bdbf26282afcc3d89eb491cafbf0aed5331b
- Size
  
  791KB
- MD5
  
  6878df738defcf088ba56b4d214ca1bd
- SHA1
  
  24a27c8c1d8a248dc76f060d7ab1cbfe5bf257a2
- SHA256
  
  fa28eef0849acaf3e0fecf455938bdbf26282afcc3d89eb491cafbf0aed5331b
- SHA512
  
  7b047edb4c5bd01d4eaa7062fd60453cb0093a80e8a3f9e62703b67fd4c78f06e04005e31dc4d6df4b39409efc730e327de4a871d109ef78a9b28dbd69ae4b78
- SSDEEP
  
  24576:UvNgtcwqLlnUwQeRHW/nSJVuPR4CZbmNrUJqh:UFVw4lnUleR2/SvoZSgE
Score

10^/10

amadey redline risepro zgrat @pixelscloud @rlreborn cloud tg: @fatherofcarders)livetraffic evasion infostealer persistence rat stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Blocklisted process makes network request
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2