amadey

General

Target

Redline Stealer_pw_infected.zip
Size

513KB
Sample

250122-m4spyasres
MD5

c0d4fc652da9344917bb6d7bb41f14e3
SHA1

0089c4bac57b008a98f86a318712bc0492f108d4
SHA256

3eef3f989e4db0c3dbc03c93a1a7e982d9d64c0ba194180ad971aa887bc428e0
SHA512

78481f34717ad0d31cd2ad970e4f0d6412a9172e58f4dee1950e5456d6ded02b79f58b0e11fad9ec66900a3de558cf710f212bb1af1c8d6bd7bf052640984517
SSDEEP

12288:hv2i8OLoscYI57ITYpICKPYfbBFmsgb+Y0j:h20LoscYIsMKPGm/+Z

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.86

Botnet

88c8bb

C2

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

savin

C2

77.91.124.156:19071

Attributes

auth_value
a1a05b810428195ab7bb63b132ea0c8d

Targets

- Target
  
  9cbfd633768db6b033e6844e5457e1f36fe6d815be40b3ce2e6b0b8e45d75090
- Size
  
  556KB
- MD5
  
  072d478f082f3d90a6813511e21148a3
- SHA1
  
  b07f0335fd719dc73b548894af6336d69b80080c
- SHA256
  
  9cbfd633768db6b033e6844e5457e1f36fe6d815be40b3ce2e6b0b8e45d75090
- SHA512
  
  1591983d3ec653f9fc3d8786aa47dda419762b53ed1874a80683fc16a76edcd296f1e2e3a9c310a1094a7415f616adbe457fba70250b25bc8f7b92781a59627e
- SSDEEP
  
  12288:DMr8y906XD2j4b7/n1fKzWGOUdo+E1MQTlt5y50Q:rylDE4bD1fKz60o+E1/RQ
Score

10^/10

amadey healer redline 88c8bb savin defense_evasion discovery dropper evasion infostealer persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Amadey family
  amadey
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1