General
-
Target
a4d903c702a8d0bbd172c1728c2f01d95ff403fd1c5262cb5e0e680685df6d5f
-
Size
1.1MB
-
Sample
241109-fwjczaxngx
-
MD5
a108420b4f2e5fdd50c32b79e4e41dfc
-
SHA1
076d9663c6216f546888dfdfb75cbb5483c42b20
-
SHA256
a4d903c702a8d0bbd172c1728c2f01d95ff403fd1c5262cb5e0e680685df6d5f
-
SHA512
1caa4260c1322cea6e637e0189df0e1e82ad4080b16d927e8d1efe305fc6d01528cc5cd075b43fbc34e156f88f43ca28cb63ae8aa64a1a15d2d66fc879078fa7
-
SSDEEP
24576:syFolnK/Vgjg0l72XTZcp1BUt2WRLQQla6f6oHfAcEY0:bX472XFcp1yEF6y4h
Static task
static1
Behavioral task
behavioral1
Sample
a4d903c702a8d0bbd172c1728c2f01d95ff403fd1c5262cb5e0e680685df6d5f.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Targets
-
-
Target
a4d903c702a8d0bbd172c1728c2f01d95ff403fd1c5262cb5e0e680685df6d5f
-
Size
1.1MB
-
MD5
a108420b4f2e5fdd50c32b79e4e41dfc
-
SHA1
076d9663c6216f546888dfdfb75cbb5483c42b20
-
SHA256
a4d903c702a8d0bbd172c1728c2f01d95ff403fd1c5262cb5e0e680685df6d5f
-
SHA512
1caa4260c1322cea6e637e0189df0e1e82ad4080b16d927e8d1efe305fc6d01528cc5cd075b43fbc34e156f88f43ca28cb63ae8aa64a1a15d2d66fc879078fa7
-
SSDEEP
24576:syFolnK/Vgjg0l72XTZcp1BUt2WRLQQla6f6oHfAcEY0:bX472XFcp1yEF6y4h
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1