amadey

General

Target
2026-04-04_8e1404674f44001cb4605d450f4faeec_amadey_elex_glassworm_icedid_njrat_redline-stealer
Size 2.3MB
Sample260404-1vxt7ady9n
SHA256 9129155b158c0112a5ae22d14cc6c7c98d118f761809bad034311ae982a284d1
MD5 8e1404674f44001cb4605d450f4faeec
SHA1 1aba7e4ffb333df1c93f7f56335d8b61560ebff7
SHA512 8dedac79eaa441d78e45fc55a16c618b3b63f1932095dd253d44faf9ef7ad2d4a835bc8a095c1394e08dbb863a54be335e1b37833387b0c85550dd2596d17cab
SSDEEP 24576:Ny2bhREc0i7S5loV4SEWWdAVDKUTbQIzFLwLIM0iwg99Vpibu9Q:o2Qc0iyU4SZVmgbQIzZMPXpB9
TLSH
T179B56A57EB914AD8E65D09366F584141D72EF261AACF2360386C520CCF8738BAF61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

amadey

Version

3.66

Botnet

6f8c0f

C2

http://62.204.41.4

Attributes

install_dir
4b9a106e76
install_file
mnolyk.exe
strings_key
eeac50d20b51124bad615e3c222346a0
url_paths
/Gol478Ns/index.php

rc4.plain

Targets

- Target
  2026-04-04_8e1404674f44001cb4605d450f4faeec_amadey_elex_glassworm_icedid_njrat_redline-stealer
- Size 2.3MB
- SHA256 9129155b158c0112a5ae22d14cc6c7c98d118f761809bad034311ae982a284d1
- MD5 8e1404674f44001cb4605d450f4faeec
- SHA1 1aba7e4ffb333df1c93f7f56335d8b61560ebff7
- SHA512 8dedac79eaa441d78e45fc55a16c618b3b63f1932095dd253d44faf9ef7ad2d4a835bc8a095c1394e08dbb863a54be335e1b37833387b0c85550dd2596d17cab
- SSDEEP 24576:Ny2bhREc0i7S5loV4SEWWdAVDKUTbQIzFLwLIM0iwg99Vpibu9Q:o2Qc0iyU4SZVmgbQIzZMPXpB9
- TLSH
  T179B56A57EB914AD8E65D09366F584141D72EF261AACF2360386C520CCF8738BAF61E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

6f8c0f defense_evasion discovery dropper evasion execution amadey healer persistence trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Amadey family
  amadey
- Detects Amadey x86-bit Payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1