amadey

General

Target

bd98d85fc24e8c6652396b25667273c74a2e29575e8aeb38f2fbb4ffa30524aa
Size

1.8MB
Sample

240528-hs7bqsbd54
MD5

26d2630ef6f3b919dec5e2b5af18d32b
SHA1

4e650852f83a3b0d2b0fa276165dfa291282fa5f
SHA256

bd98d85fc24e8c6652396b25667273c74a2e29575e8aeb38f2fbb4ffa30524aa
SHA512

90ac6b5ff3a8c8c5fbb0cdd343231b8a994c171d65558e683b06534b48f6923c1cb99d0ceed0eaccdf606f9aa2759b7e2d9b2c46af6095d80b6c7f091e70a214
SSDEEP

24576:aVAOWmoe9SUMwLGX46Af89PNfwtMH29CjG0tXZTCA3tWxvrxfZhiOWR3d8DNxJ46:OewIZ1PDf3HwCjGqTCzRgt8DNxJ4j

Score

10^/10

amadey redline 1 49e482 discovery evasion infostealer spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes

install_dir
1b29d73536
install_file
axplont.exe
strings_key
4d31dd1a190d9879c21fac6d87dc0043
url_paths
/tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:40960

Targets

- Target
  
  bd98d85fc24e8c6652396b25667273c74a2e29575e8aeb38f2fbb4ffa30524aa
- Size
  
  1.8MB
- MD5
  
  26d2630ef6f3b919dec5e2b5af18d32b
- SHA1
  
  4e650852f83a3b0d2b0fa276165dfa291282fa5f
- SHA256
  
  bd98d85fc24e8c6652396b25667273c74a2e29575e8aeb38f2fbb4ffa30524aa
- SHA512
  
  90ac6b5ff3a8c8c5fbb0cdd343231b8a994c171d65558e683b06534b48f6923c1cb99d0ceed0eaccdf606f9aa2759b7e2d9b2c46af6095d80b6c7f091e70a214
- SSDEEP
  
  24576:aVAOWmoe9SUMwLGX46Af89PNfwtMH29CjG0tXZTCA3tWxvrxfZhiOWR3d8DNxJ46:OewIZ1PDf3HwCjGqTCzRgt8DNxJ4j
Score

10^/10

amadey redline 1 49e482 discovery evasion infostealer spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2