General
-
Target
06dc9deb6904c7dddab5c24f17c295208bd64aaaf186cbd7322160c02868345aN.exe
-
Size
1.3MB
-
Sample
241111-gmxdxavckg
-
MD5
2867e824bea79d05a860d52aac69b2ef
-
SHA1
6d2bbe99c0ea801bcd85794bfa461a6a474fa05c
-
SHA256
e23ed4794ead3f85c8b72475a27e5962b603225e3d64d0d11cb2852c25617dde
-
SHA512
0466b37a93ad3b417bd03be6dff224651576a5ec818dac079547fd6b16f2043d1c605f0947911737517e3afd23d6eaf330989d1d6cd05615e3548aa040de4c89
-
SSDEEP
24576:8yHgBb1qoty2PhRk86qpbNfNZhfEtoJlc10l8QfCzJ:rAd1BtHZRk8Pb9TVEtKc19T
Static task
static1
Behavioral task
behavioral1
Sample
06dc9deb6904c7dddab5c24f17c295208bd64aaaf186cbd7322160c02868345aN.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Targets
-
-
Target
06dc9deb6904c7dddab5c24f17c295208bd64aaaf186cbd7322160c02868345aN.exe
-
Size
1.3MB
-
MD5
2867e824bea79d05a860d52aac69b2ef
-
SHA1
6d2bbe99c0ea801bcd85794bfa461a6a474fa05c
-
SHA256
e23ed4794ead3f85c8b72475a27e5962b603225e3d64d0d11cb2852c25617dde
-
SHA512
0466b37a93ad3b417bd03be6dff224651576a5ec818dac079547fd6b16f2043d1c605f0947911737517e3afd23d6eaf330989d1d6cd05615e3548aa040de4c89
-
SSDEEP
24576:8yHgBb1qoty2PhRk86qpbNfNZhfEtoJlc10l8QfCzJ:rAd1BtHZRk8Pb9TVEtKc19T
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1