amadey

General

Target

126c0f9959aa4a01bb5e8254b72b4bac370a12cddded7d815ea09b0894f1ee59.zip
Size

1.5MB
Sample

240402-l7fdcaeg33
MD5

335bb52941fc0701e7290de353a9ccc3
SHA1

b5c3cc70355b236afde20d75edd59c0c748ca4f6
SHA256

cd71a30b132d259c3897970a820488f2595f0efb71e3469da29ab0f1dbf11ad0
SHA512

0be581ad4e94bc042bbf964065bc6b4ff146bff41c99fac6e491158b2be8443757b7a5b95cfd45576ff39e98655900d200b334dc501c489d7ac05537b33c8539
SSDEEP

24576:URxfmZcLu01SkrJGJoTXbMN2hl79ECD5sUFiDk7ESm3d5Xfv6:2fCmJNgJoTX4shZ2CDbASpifv6

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

homed

C2

109.107.182.133:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Targets

- Target
  
  126c0f9959aa4a01bb5e8254b72b4bac370a12cddded7d815ea09b0894f1ee59.exe
- Size
  
  1.5MB
- MD5
  
  f536f5df19df0a0530af2b54bf26a147
- SHA1
  
  a25e39e1f67cc7a78c201182af75e04038e25240
- SHA256
  
  126c0f9959aa4a01bb5e8254b72b4bac370a12cddded7d815ea09b0894f1ee59
- SHA512
  
  e328d25a7480353a09a6ad06b6c05725f52f9f45a9b14b8b3b221f17cc72ddcf0baa29731698376a8f9c0710246c21f6cccc5f58e3adda87c73f702c78fa271e
- SSDEEP
  
  24576:zyZiQsZhOKz9F5E4HyyRyDDGk05C8XRVrT6JLUq54o0b4+U2TjfbbrSKC3:GIJcaF5hHy8y30BhT6uS4o0b1jzbuK
Score

10^/10

amadey mystic redline smokeloader homed backdoor evasion infostealer persistence stealer trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1