amadey

General

Target

b23310b86d80bffcffe35c6f92eb831253f3a28c63950541948e3a6fcf5b1e2f
Size

1.4MB
Sample

240817-z1w96szdmk
MD5

acba689ca642e4676ebd1fd468b0fdf2
SHA1

15f59843a80bc39d57d7d179fb92fd55914a53ca
SHA256

b23310b86d80bffcffe35c6f92eb831253f3a28c63950541948e3a6fcf5b1e2f
SHA512

2102f04a4801ff95f204dbf1e263a854c3c97e8ee15d990923c48475f062dd92e8a71f2a1797735e6b368f21b124819127aa807d88749b5c94cb1de7be7ada6a
SSDEEP

24576:hZtMIfEBeLGsH/U/6Tlk9cBxsM6IyfWnd5UVG8DIsEVFxgTcaBegGRyyhZ:hZtM1eXfU/slljTvy4fPTjawgoyyhZ

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

C2

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

monik

C2

77.91.124.82:19071

Attributes

auth_value
da7d9ea0878f5901f1f8319d34bdccea

Extracted

Family

amadey

Version

3.89

Botnet

daf753

C2

http://77.91.68.78

Attributes

install_dir
cb378487cf
install_file
legota.exe
strings_key
f3785cbeef2013b6724eed349fd316ba
url_paths
/help/index.php

rc4.plain

Targets

- Target
  
  b23310b86d80bffcffe35c6f92eb831253f3a28c63950541948e3a6fcf5b1e2f
- Size
  
  1.4MB
- MD5
  
  acba689ca642e4676ebd1fd468b0fdf2
- SHA1
  
  15f59843a80bc39d57d7d179fb92fd55914a53ca
- SHA256
  
  b23310b86d80bffcffe35c6f92eb831253f3a28c63950541948e3a6fcf5b1e2f
- SHA512
  
  2102f04a4801ff95f204dbf1e263a854c3c97e8ee15d990923c48475f062dd92e8a71f2a1797735e6b368f21b124819127aa807d88749b5c94cb1de7be7ada6a
- SSDEEP
  
  24576:hZtMIfEBeLGsH/U/6Tlk9cBxsM6IyfWnd5UVG8DIsEVFxgTcaBegGRyyhZ:hZtM1eXfU/slljTvy4fPTjawgoyyhZ
Score

10^/10

discovery amadey healer mystic redline smokeloader daf753 fb0fb8 monik backdoor dropper evasion infostealer persistence stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2