amadey

General

Target

004d58bf34da683aacf652abc4bf89317d4f0333b0aa0f134b257c4cc95fbcfa.exe
Size

514KB
Sample

250124-eht2wazlbq
MD5

61c9381b6c813cbb6cefa076bed31d8a
SHA1

341dd0c0375dff8d5d255b419218bc8969edc4f3
SHA256

004d58bf34da683aacf652abc4bf89317d4f0333b0aa0f134b257c4cc95fbcfa
SHA512

d1366ebdc9253e7fcc2fceba3c3ed5eceb9e223c0089b2cea2ff00a000f1e1dd750a6758d3addad6ed698b935de2aa8073631cb6019dbbe0599349a051240673
SSDEEP

12288:oMrry90IsqzgHkl/vq+19VsBUUiNyiTQ+E7ovoRHpA:Tynscli+rWSNPTQ+EUMHpA

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.86

Botnet

88c8bb

C2

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

C2

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Targets

- Target
  
  004d58bf34da683aacf652abc4bf89317d4f0333b0aa0f134b257c4cc95fbcfa.exe
- Size
  
  514KB
- MD5
  
  61c9381b6c813cbb6cefa076bed31d8a
- SHA1
  
  341dd0c0375dff8d5d255b419218bc8969edc4f3
- SHA256
  
  004d58bf34da683aacf652abc4bf89317d4f0333b0aa0f134b257c4cc95fbcfa
- SHA512
  
  d1366ebdc9253e7fcc2fceba3c3ed5eceb9e223c0089b2cea2ff00a000f1e1dd750a6758d3addad6ed698b935de2aa8073631cb6019dbbe0599349a051240673
- SSDEEP
  
  12288:oMrry90IsqzgHkl/vq+19VsBUUiNyiTQ+E7ovoRHpA:Tynscli+rWSNPTQ+EUMHpA
Score

10^/10

amadey healer redline smokeloader 88c8bb krast backdoor defense_evasion discovery dropper evasion infostealer persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Amadey family
  amadey
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1