amadey

Sharing

Copy URL

Twitter E-mail

General

Target

28692cff75bbede3c71a90e2393275a7ce52cb54abb09bde52fb20d517336cea
Size

1.8MB
Sample

240726-ysymla1glr
MD5

93ed0650f3133cb33d2d5a18cf6e9e38
SHA1

be112eea6c1db3186df8d50d2d18de625e3a6bd8
SHA256

28692cff75bbede3c71a90e2393275a7ce52cb54abb09bde52fb20d517336cea
SHA512

5373a63e3ad5db9991aeaa70fd4509a1ada6d3b1fbab3af21d208bab8ebe6ea6394c912a201e4c25d2fd6be114e6fa1b563e966c56ac435421481f7d5d30b56d
SSDEEP

24576:J8k2k2wVer2BbsnwEO/pYW1Ta5qXpjJ4qGNLBeIaO335yFI2FysOxYcjBKoHNWBB:/2wA+buQX1TEqX0L5BByFI2Hcj4UwB

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

20.52.165.210:39030

Extracted

Family

stealc

Botnet

QLL

http://85.28.47.70

Attributes

url_path
/744f169d372be841.php

Extracted

Family

redline

Botnet

25072023

185.215.113.67:40960

Extracted

Family

redline

Botnet

Logs

185.215.113.9:9137

Targets

- Target
  
  28692cff75bbede3c71a90e2393275a7ce52cb54abb09bde52fb20d517336cea
- Size
  
  1.8MB
- MD5
  
  93ed0650f3133cb33d2d5a18cf6e9e38
- SHA1
  
  be112eea6c1db3186df8d50d2d18de625e3a6bd8
- SHA256
  
  28692cff75bbede3c71a90e2393275a7ce52cb54abb09bde52fb20d517336cea
- SHA512
  
  5373a63e3ad5db9991aeaa70fd4509a1ada6d3b1fbab3af21d208bab8ebe6ea6394c912a201e4c25d2fd6be114e6fa1b563e966c56ac435421481f7d5d30b56d
- SSDEEP
  
  24576:J8k2k2wVer2BbsnwEO/pYW1Ta5qXpjJ4qGNLBeIaO335yFI2FysOxYcjBKoHNWBB:/2wA+buQX1TEqX0L5BByFI2Hcj4UwB
Score

10^/10

amadey exelastealer monster purelogstealer redline stealc 25072023 fed3aa livetraffic logs qll collection credential_access defense_evasion discovery evasion execution infostealer persistence privilege_escalation pyinstaller spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detects Monster Stealer.
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Monster
  Monster is a Golang stealer that was discovered in 2024.
  stealer monster
- PureLog Stealer
  PureLog Stealer is an infostealer written in C#.
  stealer purelogstealer
- PureLog Stealer payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detects Monster Stealer.

Exela Stealer

Monster

PureLog Stealer

PureLog Stealer payload

RedLine

RedLine payload

Stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Credentials from Password Stores: Credentials from Web Browsers

Grants admin privileges

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Downloads MZ/PE file

Modifies Windows Firewall

Stops running service(s)

Checks BIOS information in registry

Checks computer location settings

Clipboard Data

Drops startup file

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Network Service Discovery

Power Settings

Enumerates processes with tasklist

Hide Artifacts: Hidden Files and Directories

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2