amadey

General

Target

001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375
Size

722KB
Sample

250324-tevxbsstfz
MD5

542c4ead0d3004314149e8e75edfcd46
SHA1

2b7c674b2b2f6ac812a180b8e80ae7b94517685d
SHA256

001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375
SHA512

c2e933bed85e14b2b6f9495b553e284d76cb91068a86cb1252c75e35604fa87c896c158f4fed8f2f49075f038e595aac2e3deb68b8cfd7ac0d2443bfb40f2ba5
SSDEEP

12288:iMrty90M/MWArMIsV20IXvglhc585rMPJmPnCI5RMIxeMhp:7y5/ZAsDiYl2585rMPwPl+Ix5

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

C2

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

turop

C2

77.91.124.54:19071

Attributes

auth_value
288bd34bce1667b91e279fa0e1085613

Targets

- Target
  
  001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375
- Size
  
  722KB
- MD5
  
  542c4ead0d3004314149e8e75edfcd46
- SHA1
  
  2b7c674b2b2f6ac812a180b8e80ae7b94517685d
- SHA256
  
  001ece20ef94c85e55ef0a6f365b452dca11fbec2cac6f2a4df55b4c890e3375
- SHA512
  
  c2e933bed85e14b2b6f9495b553e284d76cb91068a86cb1252c75e35604fa87c896c158f4fed8f2f49075f038e595aac2e3deb68b8cfd7ac0d2443bfb40f2ba5
- SSDEEP
  
  12288:iMrty90M/MWArMIsV20IXvglhc585rMPJmPnCI5RMIxeMhp:7y5/ZAsDiYl2585rMPwPl+Ix5
Score

10^/10

amadey healer redline smokeloader 59b440 turop backdoor defense_evasion discovery dropper evasion infostealer persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Amadey family
  amadey
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1