amadey

General

Target

a3856df71eb61ea894a02826e7ea581b042c79602ab859be3aad16f0a039ffbc.zip
Size

1.5MB
Sample

240402-mpmv5sfh24
MD5

f10adaa7ae4d3de6e1571b3ca5cd775e
SHA1

a1f4a9decd6c5d13b6a745b3d3f0e2eca7c94abb
SHA256

690624c10c7f134779b6cb3c6f3bc8bc0ae4795fe3ebb5840879e4c2f1e34b69
SHA512

ad69f531776040e273f862bdd4d81800b1051ce2965412a2b5ae9b0a8f08b22bd6ff43e5d03b1445c48914b4869f3bc9b80ba4c6ae90e24ece644453cb664504
SSDEEP

49152:KJfaHl6XSxB4LQ/KMz0snlrLYJu+l/R9Ageee2SapAx:aTigL97snlrWl/rw5aA

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Targets

- Target
  
  a3856df71eb61ea894a02826e7ea581b042c79602ab859be3aad16f0a039ffbc.exe
- Size
  
  1.6MB
- MD5
  
  dc32132299c4239e0d54d9f1731dff15
- SHA1
  
  7db45bd474049fc304172c57782cf5b2f3db8862
- SHA256
  
  a3856df71eb61ea894a02826e7ea581b042c79602ab859be3aad16f0a039ffbc
- SHA512
  
  6e8667cc95db7da46df710483d326d9035d83fa9e004b46fc598d4ea09f25063945fc53a4e05e08bd3e8c902069ff0aca866e1c699bab9bfcc4c3ac16442faca
- SSDEEP
  
  49152:JTl2GRpauWfLwGUoOosLdc6Un/eDAzQJJpHjRYVhN:58GoOGUosyRlzQJbjRYV
Score

10^/10

amadey dcrat mystic redline smokeloader grome backdoor evasion infostealer persistence rat stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1