Resubmissions

29-10-2024 10:37

241029-mnv55avbqk 10

05-05-2023 19:46

230505-yg72wscd81 10

General

  • Target

    d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f.bin

  • Size

    1.2MB

  • Sample

    241029-mnv55avbqk

  • MD5

    74b0ccf3de68e8e63088a697bccced26

  • SHA1

    d3d8252558125ac843ac3c339bab3641e23a61d5

  • SHA256

    d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f

  • SHA512

    85de1d6d8b4ec19a3b82ecbbd41ce129742c63fd306214bb37c3005733056a7cab7c5a3765c41612a00d5e12c694f11864146e69fb723d696ce18a50caec74c9

  • SSDEEP

    24576:LyfKfMXMQEseAkUF4Owq7/nqC0fIXSV8UQRBQfU3LEI:+fwMc5PCF4OhPqC0fzQLQfOL

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Targets

    • Target

      d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f.bin

    • Size

      1.2MB

    • MD5

      74b0ccf3de68e8e63088a697bccced26

    • SHA1

      d3d8252558125ac843ac3c339bab3641e23a61d5

    • SHA256

      d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f

    • SHA512

      85de1d6d8b4ec19a3b82ecbbd41ce129742c63fd306214bb37c3005733056a7cab7c5a3765c41612a00d5e12c694f11864146e69fb723d696ce18a50caec74c9

    • SSDEEP

      24576:LyfKfMXMQEseAkUF4Owq7/nqC0fIXSV8UQRBQfU3LEI:+fwMc5PCF4OhPqC0fzQLQfOL

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.