amadey

General

Target

4280e6e70fceb92c11d7de42e14854783d09a551769b9117097cd4a5affe3b35.zip
Size

1.5MB
Sample

240402-qe2s4aah31
MD5

bbf90dd36c9356f2bee4a9ae205e8163
SHA1

4e2f33fc1ddbc32043b83dc763506e555e55efae
SHA256

66af6bcbc768a1e6b57b31bb0e5016e2c5414e61f60b73ef3e5ca74fdcce06b5
SHA512

79d16bd48ec8a5ddc615babdc0c902c602cc2585feeda901590880fe744b75f83ac85ed11d07b7399d073d97f8348d3e58b12039c27b434659098c77b9cd00d6
SSDEEP

24576:TmucYF8d42kjzXQA0hX43b+YYTTLLAN4EQB0REPG9QcoHp6TundOJ0MJJGy5ekzq:a+k2nAAgo3bITLLtQkGirHUR0MJJ/Lzq

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Targets

- Target
  
  4280e6e70fceb92c11d7de42e14854783d09a551769b9117097cd4a5affe3b35.exe
- Size
  
  1.5MB
- MD5
  
  e51db332898f96c123006867309d8ff7
- SHA1
  
  5f0766969d31cdc281703bfe21e6f94e9625a039
- SHA256
  
  4280e6e70fceb92c11d7de42e14854783d09a551769b9117097cd4a5affe3b35
- SHA512
  
  3a54dbacec0c202fcbfc9bf963eec06ddd3d0a05158504a389d39c734942fc4e20177a1d4e1700262b8e1da1548d57ce75650f10b100175a560d2891e25b7c10
- SSDEEP
  
  49152:gM3XFzwFlHHkXZ2spmEitbxvbmLOBgqRQqWr:zHF8FVHkXZ/pMt9jmLFq2q
Score

10^/10

amadey dcrat mystic redline smokeloader grome backdoor paypal evasion infostealer persistence phishing rat stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral1