amadey

General

Target

779645914bf2b4b7d085520366334ca0c2b3467e078ba4a67a350ee51b14249d
Size

3.7MB
Sample

240126-rnsr8afeg3
MD5

375d27546ead4912dbc521a80fdb6667
SHA1

1cc412a3ff8d1cae4a49bcf73955c90c6edebbd2
SHA256

779645914bf2b4b7d085520366334ca0c2b3467e078ba4a67a350ee51b14249d
SHA512

145fd6741f9a1ea1d5cbe1df7b5d00e02240fe490e0f1e5afc10665238100ef97df3af65e70da0fee140850b3f9ddeafb364a01783da71b5cd17db7bb3779cf6
SSDEEP

98304:r78aFxy7nmvsL3c6J3oAlYpSy+/rHKngEb7HUv6xb:r7X+mvLcV8SL+ng8Ph

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.15

C2

http://185.215.113.68

Attributes

install_dir
d887ceb89d
install_file
explorhe.exe
strings_key
7cadc181267fafff9df8503e730d60e1
url_paths
/theme/index.php

rc4.plain

Extracted

Family

redline

Botnet

2024

C2

195.20.16.103:20440

Extracted

Family

redline

Botnet

@RLREBORN Cloud TG: @FATHEROFCARDERS)

C2

141.95.211.148:46011

Targets

- Target
  
  779645914bf2b4b7d085520366334ca0c2b3467e078ba4a67a350ee51b14249d
- Size
  
  3.7MB
- MD5
  
  375d27546ead4912dbc521a80fdb6667
- SHA1
  
  1cc412a3ff8d1cae4a49bcf73955c90c6edebbd2
- SHA256
  
  779645914bf2b4b7d085520366334ca0c2b3467e078ba4a67a350ee51b14249d
- SHA512
  
  145fd6741f9a1ea1d5cbe1df7b5d00e02240fe490e0f1e5afc10665238100ef97df3af65e70da0fee140850b3f9ddeafb364a01783da71b5cd17db7bb3779cf6
- SSDEEP
  
  98304:r78aFxy7nmvsL3c6J3oAlYpSy+/rHKngEb7HUv6xb:r7X+mvLcV8SL+ng8Ph
Score

10^/10

rhadamanthys collection discovery evasion persistence spyware stealer trojan amadey redline xmrig zgrat 2024 @rlreborn cloud tg: @fatherofcarders)infostealer miner rat
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2