amadey

General

Target

4ee60c6722bcce37fdd901bfbff058fb.exe
Size

2.5MB
Sample

240205-rzq3rscban
MD5

4ee60c6722bcce37fdd901bfbff058fb
SHA1

b7579547eb1eb9d9520e4f367c42e1204dc9ad1a
SHA256

3a134837e2603fb96e6096f6d804472de18bc8b78bc7264d766a02c363ebe8f0
SHA512

d1c65eb635e0e45eb11180adc30291ba4b4126e0f1b7efb801974832d378b325a5989a5cb36f0b6653cd88f92ed11b17195dacf66eac4c89634f86e1b21e798f
SSDEEP

49152:jPfhe3bxwpBz5ZtYYnY50pu4hzRcjb2hjzCgWeIjWDu9aq3vKvq:ThZrLnYuu4hyjidzvWeof9awvGq

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

risepro

C2

65.109.90.47:50500

193.233.132.62:50500

Extracted

Family

redline

Botnet

LiveTrafic

C2

20.79.30.95:33223

Targets

- Target
  
  4ee60c6722bcce37fdd901bfbff058fb.exe
- Size
  
  2.5MB
- MD5
  
  4ee60c6722bcce37fdd901bfbff058fb
- SHA1
  
  b7579547eb1eb9d9520e4f367c42e1204dc9ad1a
- SHA256
  
  3a134837e2603fb96e6096f6d804472de18bc8b78bc7264d766a02c363ebe8f0
- SHA512
  
  d1c65eb635e0e45eb11180adc30291ba4b4126e0f1b7efb801974832d378b325a5989a5cb36f0b6653cd88f92ed11b17195dacf66eac4c89634f86e1b21e798f
- SSDEEP
  
  49152:jPfhe3bxwpBz5ZtYYnY50pu4hzRcjb2hjzCgWeIjWDu9aq3vKvq:ThZrLnYuu4hyjidzvWeof9awvGq
Score

10^/10

amadey trojan redline risepro xmrig zgrat livetrafic evasion infostealer miner persistence rat stealer upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2