General

  • Target

    20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c

  • Size

    516KB

  • Sample

    241110-cmgk8sxdqc

  • MD5

    9374623db2f9a296cfd045042ee382de

  • SHA1

    3007e721612844507fe1d05d1ce42edc6433e029

  • SHA256

    20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c

  • SHA512

    e08b9175b6e982b87551a919d10fcf694c0bd3ca2a5866cb7e05b2454a6b4946cb6772f982742d701ef93bc2c4074843a90f8df59a774e451d883e23ffb5e179

  • SSDEEP

    12288:mMrny90IrWD+Fg2FHxZI2s0KtuvxUkgBYCKNLzr:By9pzw2J6rzgLP

Malware Config

Extracted

Family

amadey

Version

3.86

Botnet

88c8bb

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

gotad

C2

77.91.124.84:19071

Attributes
  • auth_value

    3fb7c1f3fcf68bc377eae3f6f493a684

Targets

    • Target

      20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c

    • Size

      516KB

    • MD5

      9374623db2f9a296cfd045042ee382de

    • SHA1

      3007e721612844507fe1d05d1ce42edc6433e029

    • SHA256

      20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c

    • SHA512

      e08b9175b6e982b87551a919d10fcf694c0bd3ca2a5866cb7e05b2454a6b4946cb6772f982742d701ef93bc2c4074843a90f8df59a774e451d883e23ffb5e179

    • SSDEEP

      12288:mMrny90IrWD+Fg2FHxZI2s0KtuvxUkgBYCKNLzr:By9pzw2J6rzgLP

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks