amadey | 56051dec3a81f682e933b6ab4880ffbddc88825a6eceafb5dc6e092fce147c85 | Triage

Sharing

General

Target

67f9a2786a9a73589d085e99e804b940N.exe
Size

1.5MB
Sample

240820-wbsnxavflf
MD5

67f9a2786a9a73589d085e99e804b940
SHA1

5ab5932fb9911e4ec1d15dfe105a087b61a1fe7d
SHA256

56051dec3a81f682e933b6ab4880ffbddc88825a6eceafb5dc6e092fce147c85
SHA512

f6365ac23178ddc5bc7d389544fbe39e30618bfbce994f581bf15e164dde2647378f5ab911bd375197c228ef66839524821a544da8ebfb4fe78c4f295bc56298
SSDEEP

24576:MyAFpBH4CDp0x1XDG/ARZtNEXSUM7OrPbe4IET7NBtgxn86y1Zj3yXZiG0hC2t6:7ApHv+G3KuPNLT7xgt8NjgN0w2

Score

10^/10

amadey mystic redline smokeloader 04d170 grome backdoor discovery evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

Botnet

04d170

C2

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Targets

- Target
  
  67f9a2786a9a73589d085e99e804b940N.exe
- Size
  
  1.5MB
- MD5
  
  67f9a2786a9a73589d085e99e804b940
- SHA1
  
  5ab5932fb9911e4ec1d15dfe105a087b61a1fe7d
- SHA256
  
  56051dec3a81f682e933b6ab4880ffbddc88825a6eceafb5dc6e092fce147c85
- SHA512
  
  f6365ac23178ddc5bc7d389544fbe39e30618bfbce994f581bf15e164dde2647378f5ab911bd375197c228ef66839524821a544da8ebfb4fe78c4f295bc56298
- SSDEEP
  
  24576:MyAFpBH4CDp0x1XDG/ARZtNEXSUM7OrPbe4IET7NBtgxn86y1Zj3yXZiG0hC2t6:7ApHv+G3KuPNLT7xgt8NjgN0w2
Score

10^/10

amadey mystic redline smokeloader 04d170 grome backdoor discovery evasion infostealer persistence stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Query Registry

System Information Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

amadeymysticredlinesmokeloader04d170gromebackdoordiscoveryevasioninfostealerpersistencestealertrojan