amadey

General

Target

c9723e93969f23222dd7f7efb535d090_NEAS
Size

1.8MB
Sample

240507-ss4wqafc98
MD5

c9723e93969f23222dd7f7efb535d090
SHA1

5477b16d562d678d9228d3840261b3cd6548694b
SHA256

8285e1267c0f625c1261da0f93c5b1364372593b86d167e2895aceccf020d692
SHA512

0be677a0a382de4fcb6c38d32ce06012abc39c78d0fe9f6d1a84826e5b0aae744b52ccb0a47be2ee736ff6c6413293792f9202c40fc5bd39b5e6b4e62c1e18a1
SSDEEP

49152:ZgoFLCeZjLChW4eaemmcFilPRhwVfDflLSFWx:ZgKLfrzEmRRhwVZLSFW

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes

strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Targets

- Target
  
  c9723e93969f23222dd7f7efb535d090_NEAS
- Size
  
  1.8MB
- MD5
  
  c9723e93969f23222dd7f7efb535d090
- SHA1
  
  5477b16d562d678d9228d3840261b3cd6548694b
- SHA256
  
  8285e1267c0f625c1261da0f93c5b1364372593b86d167e2895aceccf020d692
- SHA512
  
  0be677a0a382de4fcb6c38d32ce06012abc39c78d0fe9f6d1a84826e5b0aae744b52ccb0a47be2ee736ff6c6413293792f9202c40fc5bd39b5e6b4e62c1e18a1
- SSDEEP
  
  49152:ZgoFLCeZjLChW4eaemmcFilPRhwVfDflLSFWx:ZgKLfrzEmRRhwVZLSFW
Score

10^/10

amadey redline stealc zgrat test1234 evasion execution infostealer rat stealer themida trojan @cloudytteam
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect ZGRat V1
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2