General

  • Target

    234d1b4d01870354f0a7a173da477d07c9b3eca7dd6c6fcd7a00827f4506c206

  • Size

    1.2MB

  • Sample

    241109-fw4c5syclr

  • MD5

    2f689133cd22b0c65c246a32485c1a20

  • SHA1

    54b3d0b1443720abb99633bcaf5c71601e5c2de8

  • SHA256

    234d1b4d01870354f0a7a173da477d07c9b3eca7dd6c6fcd7a00827f4506c206

  • SHA512

    cecefa581b08b486cb700920e73f36602120e9f290f2cf9bdb8a296a828de551dc1a9596464252642345d475dcdbf4e270543db601b8762232d279c247c3105f

  • SSDEEP

    24576:+ycDNhhiP3AUmtQnt1rwWg/EEKWuMi6bv4/gW1WaJ6T:NcDrhiP3AVtAt1rDQrv4/J1R

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

8c4642

C2

http://193.201.9.240

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    c7c0f24aa6d8f611f5533809029a4795

  • url_paths

    /live/games/index.php

rc4.plain

Targets

    • Target

      234d1b4d01870354f0a7a173da477d07c9b3eca7dd6c6fcd7a00827f4506c206

    • Size

      1.2MB

    • MD5

      2f689133cd22b0c65c246a32485c1a20

    • SHA1

      54b3d0b1443720abb99633bcaf5c71601e5c2de8

    • SHA256

      234d1b4d01870354f0a7a173da477d07c9b3eca7dd6c6fcd7a00827f4506c206

    • SHA512

      cecefa581b08b486cb700920e73f36602120e9f290f2cf9bdb8a296a828de551dc1a9596464252642345d475dcdbf4e270543db601b8762232d279c247c3105f

    • SSDEEP

      24576:+ycDNhhiP3AUmtQnt1rwWg/EEKWuMi6bv4/gW1WaJ6T:NcDrhiP3AVtAt1rDQrv4/J1R

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks