General

  • Target

    d659831f7d1e576995ff9251550ac1ca201bfa2aa17f96644ff3a7a9d919671f

  • Size

    1.1MB

  • Sample

    241111-bwd12azdmf

  • MD5

    28cb4c440a52207cf0135da5c110ca2a

  • SHA1

    d934ad7149ce469ea23bde108b09ba2a4a861df8

  • SHA256

    d659831f7d1e576995ff9251550ac1ca201bfa2aa17f96644ff3a7a9d919671f

  • SHA512

    be4d4ae2f720af348db25e7bcb7b959946cdade17b2ff635527bdb44177282c63ff5eb9c2c2e97cca64fa03b27f4bcebbff52fd6ab126d0210b52dfc3bd71640

  • SSDEEP

    24576:8y0toY5J3SbTvXyuYRyPdJG/wvL/DBhARUfbcvmhW2PwZ7qNfpjS:r0t158fCuY0PdDvbUi0L/pqRp

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Targets

    • Target

      d659831f7d1e576995ff9251550ac1ca201bfa2aa17f96644ff3a7a9d919671f

    • Size

      1.1MB

    • MD5

      28cb4c440a52207cf0135da5c110ca2a

    • SHA1

      d934ad7149ce469ea23bde108b09ba2a4a861df8

    • SHA256

      d659831f7d1e576995ff9251550ac1ca201bfa2aa17f96644ff3a7a9d919671f

    • SHA512

      be4d4ae2f720af348db25e7bcb7b959946cdade17b2ff635527bdb44177282c63ff5eb9c2c2e97cca64fa03b27f4bcebbff52fd6ab126d0210b52dfc3bd71640

    • SSDEEP

      24576:8y0toY5J3SbTvXyuYRyPdJG/wvL/DBhARUfbcvmhW2PwZ7qNfpjS:r0t158fCuY0PdDvbUi0L/pqRp

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.