General
-
Target
9b12d288bef4bdb9dedf6ff882763352.bin
-
Size
529KB
-
Sample
230620-bxsktaad7v
-
MD5
18414a06bd8cb01d5d4003cf92fb156e
-
SHA1
22886ce96366625f9e0e5da9290bf7094b7ee8cf
-
SHA256
4bd5c7a11a2aa1c7664f22f7fc384332124f76737cebe38a4c37d798ab2fd488
-
SHA512
bb1d9311b8b64c4660bb05b92de8fa2f8457a84196dfe08f399d649897526c513cde403425283ee24b5dc7732da17af04660b6c666985b9e20bf4fd29a29b4e9
-
SSDEEP
12288:XgwQ0FXQwT8neYlswB5cErFZEI9bk+OGUWDHPoVVu9R:wwNmhlswnc4ZEI98GUWjoVVu9R
Malware Config
Extracted
redline
duza
83.97.73.129:19071
-
auth_value
787a4e3bbc78fd525526de1098cb0621
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
jason
83.97.73.129:19071
-
auth_value
87d1dc01751f148e9bec02edc71c5d94
Targets
-
-
Target
ec71edee6e23a115e4ae9703efa5d7612c03756f6815b198ab1a96ac4fb2668d.exe
-
Size
572KB
-
MD5
9b12d288bef4bdb9dedf6ff882763352
-
SHA1
9ad23e0ea72d2c7e8aceee166434e43a489e6936
-
SHA256
ec71edee6e23a115e4ae9703efa5d7612c03756f6815b198ab1a96ac4fb2668d
-
SHA512
13b3599a6a0dea8c464b735e7c1d37b5d0cfa42855f298b993b529281f0be631ba5188cfd3c955b56968374b0b08b5a4caa04d2304cf68da69732ef5777b18cc
-
SSDEEP
12288:BMrCy90sklhQK+sxFUW8ba/cBHBc5s5K6vGtb06GDbAeF:7yQ+cFUR840so6vGt0YM
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-