General
-
Target
2a11527c8cebf25f2b3bfa4f4d7b72bf22b3b0d6c907c026f5a696f79b017fd6
-
Size
1020KB
-
Sample
241111-ggxgqaxneq
-
MD5
d7db98c33985cb5560061b464b67e9e5
-
SHA1
af6aa3d070f16e2ae7fd4cf4b946ec5423821d18
-
SHA256
2a11527c8cebf25f2b3bfa4f4d7b72bf22b3b0d6c907c026f5a696f79b017fd6
-
SHA512
708674c38dda223894deff639cd968b1d2a981c180fd35c1185a3ef33914c32b619e89cf58a3350a1dfc45f8d92567c242f5e4d47e2016498850896d35ad437d
-
SSDEEP
24576:9yKfeYsmkwi2aIQHp6QjjgLiaGSSXdB9oTG/CDocQ4UcwYo:YKmYCjHHp6Qjjha0Xdj4DScwY
Static task
static1
Behavioral task
behavioral1
Sample
2a11527c8cebf25f2b3bfa4f4d7b72bf22b3b0d6c907c026f5a696f79b017fd6.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Targets
-
-
Target
2a11527c8cebf25f2b3bfa4f4d7b72bf22b3b0d6c907c026f5a696f79b017fd6
-
Size
1020KB
-
MD5
d7db98c33985cb5560061b464b67e9e5
-
SHA1
af6aa3d070f16e2ae7fd4cf4b946ec5423821d18
-
SHA256
2a11527c8cebf25f2b3bfa4f4d7b72bf22b3b0d6c907c026f5a696f79b017fd6
-
SHA512
708674c38dda223894deff639cd968b1d2a981c180fd35c1185a3ef33914c32b619e89cf58a3350a1dfc45f8d92567c242f5e4d47e2016498850896d35ad437d
-
SSDEEP
24576:9yKfeYsmkwi2aIQHp6QjjgLiaGSSXdB9oTG/CDocQ4UcwYo:YKmYCjHHp6Qjjha0Xdj4DScwY
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1