amadey

General

Target

b38fe213704c50c252032bdee6ee365d.bin
Size

780KB
Sample

240205-dpxkxahbd7
MD5

8244101c262201def45bb97216c9fa39
SHA1

6e104699dec488c8ce579ab8baac9093bcb986bf
SHA256

a03af7f953a570031ebc4c016fb4009bb31c5535829ab82b6126bff5c222a86e
SHA512

8e95267539bac83b6c7c5dc32a51f30f0cc24bddd420341c515c797b4b053f1cbab499a68db12e18a9d8526ab855867db2339ed4552d3e1721f290a0d64233a1
SSDEEP

24576:dJbAqZign13LLr/WZu18KW8lqye2vVxoGM:dJMKignx3r/Yu35qye2NOd

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.15

C2

http://185.215.113.68

Attributes

install_dir
d887ceb89d
install_file
explorhe.exe
strings_key
7cadc181267fafff9df8503e730d60e1
url_paths
/theme/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

@oni912

C2

45.15.156.209:40481

Extracted

Family

redline

Botnet

@PixelsCloud

C2

94.156.67.230:13781

Extracted

Family

redline

Botnet

LiveTrafic

C2

20.79.30.95:33223

Extracted

Family

risepro

C2

193.233.132.62:50500

Targets

- Target
  
  a3791f9a33de62edfcfbb4bad919ed4dfdf81b914ce7af5120233bd20228765b.exe
- Size
  
  792KB
- MD5
  
  b38fe213704c50c252032bdee6ee365d
- SHA1
  
  57066b081670b153ff20ed89d6c8c7394a8fa2cf
- SHA256
  
  a3791f9a33de62edfcfbb4bad919ed4dfdf81b914ce7af5120233bd20228765b
- SHA512
  
  0a5693ffce16e2b0d89da12a78c87206bdeb8ce8f93ea60bd24c9b2f73acf9284ce1e4c002564305e0d79b50613539e3b2d711c8bba21653186010a094d97f05
- SSDEEP
  
  24576:KjL7Ymvzb2nlwQDsiK32YsP/rYmnt5pt:6b2nllE32Ysnrz
Score

10^/10

amadey redline @oni912 @pixelscloud livetrafic evasion infostealer persistence trojan risepro stealer
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Modifies boot configuration data using bcdedit
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2