General
-
Target
db253ba569f2268c29fa8f944d606268c9c8527f6fb6bcf3bd786da42c994c2e
-
Size
1.1MB
-
Sample
241110-bwbwnsyrgr
-
MD5
901e82946b09c6f856e8f0a7035fd4af
-
SHA1
02d53bf9c05647b1d97d0ddef4f4d3f03ba63410
-
SHA256
db253ba569f2268c29fa8f944d606268c9c8527f6fb6bcf3bd786da42c994c2e
-
SHA512
2c8cbec8cdc914e1421ee6dec95557cfa6f77310d83ff4d2f0c21eeb8e0fe51b4b2065de059df091db799162adc085d9328ad5298cf69ca4b25f43f86aa31444
-
SSDEEP
24576:ry3sIE2xnCS061mo5fB/5HLaA2h/K1jIIvKm9dYj6XwScvmfWuFw07M4wSs:e3s6CP9kF952ZK1EsUVlp075
Static task
static1
Behavioral task
behavioral1
Sample
db253ba569f2268c29fa8f944d606268c9c8527f6fb6bcf3bd786da42c994c2e.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Targets
-
-
Target
db253ba569f2268c29fa8f944d606268c9c8527f6fb6bcf3bd786da42c994c2e
-
Size
1.1MB
-
MD5
901e82946b09c6f856e8f0a7035fd4af
-
SHA1
02d53bf9c05647b1d97d0ddef4f4d3f03ba63410
-
SHA256
db253ba569f2268c29fa8f944d606268c9c8527f6fb6bcf3bd786da42c994c2e
-
SHA512
2c8cbec8cdc914e1421ee6dec95557cfa6f77310d83ff4d2f0c21eeb8e0fe51b4b2065de059df091db799162adc085d9328ad5298cf69ca4b25f43f86aa31444
-
SSDEEP
24576:ry3sIE2xnCS061mo5fB/5HLaA2h/K1jIIvKm9dYj6XwScvmfWuFw07M4wSs:e3s6CP9kF952ZK1EsUVlp075
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1