MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e
SHA3-384 hash: 932c1799ceaf65d904f5c43b7434b2a852dc679c6cec15f0e5d54de3cc0384f89df91662bb12a880d4895871b0230b57
SHA1 hash: a634bc63dad946cd33d82ba5c3e167e491187971
MD5 hash: 4835fcb86507f776824633239c8b503f
humanhash: india-single-nebraska-bacon
File name:345.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:1'054'720 bytes
First seen:2023-05-20 16:50:48 UTC
Last seen:2023-05-20 16:57:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 24576:3ys3+o+aEVABCJQhdIQ0ZKlowTraMTYLTDGg7p7M1:C5olEYCJQr0ZwqMT8mo
TLSH T197252302FBD855B3F8B60BB058F743D70A36FC919C3843572786D95B48B3A9468B136A
TrID 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter Neiki
Tags:Amadey

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
345.exe
Verdict:
Malicious activity
Analysis date:
2023-05-20 16:53:58 UTC
Tags:
rat redline amadey trojan loader
Link:
https://app.any.run/tasks/cbbc325c-5ec0-427f-8f5a-53b02acc2fba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching a service
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Stealing user critical data
Blocking the Windows Defender launch
Disabling the operating system update service
Unauthorized injection to a recently created process by context flags manipulation
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/86103/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack.dll anti-vm CAB greyware installer lolbin packed rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6468fa7a2c9b4b5d2f1c964e/reports/5826d471-872c-4b45-8701-f99c52207fcc/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f986a04b-be87-4841-b13a-0a873e906f80
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1238284
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 871279 Sample: 345.exe Startdate: 20/05/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 10 other signatures 2->51 8 345.exe 1 4 2->8         started        11 rundll32.exe 2->11         started        13 rundll32.exe 2->13         started        15 rundll32.exe 2->15         started        process3 file4 39 C:\Users\user\AppData\Local\...\x6215726.exe, PE32 8->39 dropped 41 C:\Users\user\AppData\Local\...\i8269643.exe, PE32 8->41 dropped 17 x6215726.exe 1 4 8->17         started        process5 file6 31 C:\Users\user\AppData\Local\...\x5061516.exe, PE32 17->31 dropped 33 C:\Users\user\AppData\Local\...\h6206675.exe, PE32 17->33 dropped 53 Antivirus detection for dropped file 17->53 55 Multi AV Scanner detection for dropped file 17->55 57 Machine Learning detection for dropped file 17->57 21 x5061516.exe 1 4 17->21         started        signatures7 process8 file9 35 C:\Users\user\AppData\Local\...\g9890241.exe, PE32 21->35 dropped 37 C:\Users\user\AppData\Local\...\f5247874.exe, PE32 21->37 dropped 59 Antivirus detection for dropped file 21->59 61 Multi AV Scanner detection for dropped file 21->61 63 Machine Learning detection for dropped file 21->63 25 f5247874.exe 4 21->25         started        29 g9890241.exe 9 1 21->29         started        signatures10 process11 dnsIp12 43 77.91.68.253, 19065, 49701, 49702 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 25->43 65 Antivirus detection for dropped file 25->65 67 Multi AV Scanner detection for dropped file 25->67 69 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 25->69 77 2 other signatures 25->77 71 Machine Learning detection for dropped file 29->71 73 Disable Windows Defender notifications (registry) 29->73 75 Disable Windows Defender real time protection (registry) 29->75 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e/
Threat name:
Win32.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2023-05-20 16:51:07 UTC
File Type:
PE (Exe)
Extracted files:
118
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jsw2lpe6qk4t5aer3kjqdxhjvl4qmek5pujquqgjngi2wjyu25xa._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:deren discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/230520-vctf6agb2t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine payload
Malware Config
C2 Extraction:
77.91.68.253:19065
Unpacked files
SH256 hash:
c42c4181c3e5986338fe83304afa62bc3532e56b614e999aa28b65447316fe6f
MD5 hash:
21ed125865cd7bd672e835466b1551da
SHA1 hash:
d642b7dac17e3210b3a34bbf8fd9282bf9c580fe
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/16fc5f8a-e46d-448b-981d-a548cf393de3/
Parent samples :
137f040c851e03f92823a1095f5aa284f7208caa5f3ae8ad678988f7626b6882
f14f3eb79738f392dbc6667d382dcf74cbee3e796092de891d39d66ddfb8c1c7
99789a1eb6f137364d3dc285ad6bf62edd1142f386586c008b409529cdd2b666
d520d0a3bec456986553675f6a60a92e2b5efc61d7099228b18fce3525cb1965
646088e6cd38244c299e62ec5e456a4e8b4a0393602de42181380595d5cce57f
4107f199d6e98f570d2caf4bb81a9a889d7558c242cd6984550317bd89598a59
e53bd8d9458c25d81bfcfd7a9a03572429e86d80d7829ec1e3c24556dfff3f1b
10ab0290093184e094f84af4798585c366bf5013d4954d5a90f50abe0655ba1f
b2fd7968c35b3c26ba361e3d32015a94793dfc3312cf711e9bf23ae6325f0f19
d3cebf550355c5ef5eb213fb762c3add9a0b58a06b2aee542342a999a0e9e3a8
825dfe48062002a35ba01cb1b4114468be1e478d100b2b63bacd2162c41c806f
ff347aab721f9742ce05958e193232cf298756778d769f8d62b2cbd768c7f326
9a3380f918e8d137eeb28cf4a24289904217c98041f83c02661db7cf212c4ed3
2197586b6439e362fa612f1035cabaee5a64293a850f50bef562b4df615d9550
1f3f6144648299ea64ccfce0a00ae78ffd76f2068c52000bcc0c772ee02d5335
1c86bb59740f3710cc5b755991d1ce2f22961e939247dd81374cd14ad78b9ef2
db6306215e0fbed64f5093fd3a78511654fedad60ad8036ce7dde9f45dfa2fe5
44bdbdadb0220a4b88fe183c8e62dc93efeff157036dedfae7ca5aca487d15ce
5d51caadec5672a1910726b7ccf2100a88f7ad809c712e74024ef2b330ddec7b
a77ef6de5912cbd676b798f45fed91a7314b9ad1aca464c4dcbd23ae63995e02
670b019c303190592bfd9cf06c5b46b676cc3db7104664e535ebf35ca8b0431c
11a611b132bb86919750c5430f157a630b25e9a573db6ac5ccadbf50c3606a3f
88e10bb65c0ca2af9262bcadad39eb60a21e037f76e018425ca2333a98851f02
6fadef11cbfbf357aaf69dde5e95aeac88787d1835ca4234667d3ade0e2ad198
27797974837bdaceda419c104f03ddf9b8f2f61609c7b70d56a27f0a5b191ed5
34a2ce2cacfe70b81c5b3ebd1bf39d3772c17924442272e1cc77be537bd49d98
49067ad06f7e88a216359704d4f5b2220e81a98e7cd38fe9635dcced23aae3da
dc26facf6d78dd67497d26b2bce53f5d75a2c2fcdbae226f3efc9ea09cddba80
e2a26075a09efb7052c7e7cea0cd353dcc817a9a42db90a9dcd4f11f4fba1bf8
76668462759315c9354b9422e0550cd3befd34b35f79b87578084dbf44e89dd7
c1b96a261643e29186af75d1c13f4b310a9563c6bf626d6d074ad01109e8c43b
a9a6908a8a7efe1330f2964b55833bc6061086bcfe54c57e71efd8abaa73b00b
845c2f7b81953b3d5f1419c14648f852e6c5edebfa4e176ff75b8f236402022b
982a104d110f82375b04015ac03ab499d219e902f89acb6655ebbe79f642365d
4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e
81ce76d33d304d1909a1169f8a1908899e3cfd17d78836a5dbb6ada4d726716d
7e9b4ed4d92b0ad92f877ae769961461fa001f0fdfada370102eedea00b6b0d4
5ec32631a87f54a0bf4a5223995bb44922254865aa4f302b34a6037821060044
2225316305e207606a1699df51f2ecec4d7ba1e57903436d10f99c3f72b211f6
785481179aa8914e3c8dcb43a93804089363f057c0cfe43d892bb0da629a4e88
7028e76632c233c35eb952013fae76a3ff77b5bc2c84bbb5ed6989063a9323f7
4b21acc320a5c0ba3ad4003d5dbb6648bd84624ec19c11ec0e297b8e931231a5
96a4c4f58bfd5094f9949625b89169a5b2ee1bf2b3bfc48099500bbf9eebbf8b
4cdc2dcba10a7a3778f06d835eb61464fb67ff0bf6f756ef73b1da4720c80cc7
5cefc3ac6f11a1fb5846ddf517f6d8ac863c332e7fa29e23228c07c829b8efee
ee0be10e82e493002f19223b7688965b0a41917a2e037a3b4061532d9709aeb9
d6ac7634a16cfbfbbb744cfe0321798fafbf7e8bdc5a8ef13e3fc0d5760c0651
820aa2d8278af28e5533ea9842ce2a78419a864878a0fc48e2c9eaf9b43b6cdf
a485e59eb316bad0a19f6b42d0d0c5c07f86398938bbc2ee36515f1c4096aa01
833bc1b1adabeea44495a4c5a6884e629c3f564653cafa8ec2a9e8862a8fc365
38f4f79862e8b005cdda25651b57527818eaa1b9914f4d829007cc2528058875
70ac042a67c0d0fcb0015807cb14017a4479d4bf15a3d07c07dca603d9576186
a81ba345213a66db164ce21e006831d134e7e8897ddfe9543815cd0e058e498c
2f6ff7c40d7288cebdfbe7861c98d119bb4c13aa2beab66ae5a5e56b32abfcfb
d0d3696a4878d1df5768dbb1b9646c68070e82b5d8711cf51db81af4b02aea05
557d1499f4f440e7e60572e0f651c2030c3384b87810af4b50e75e7069f48d9e
c66ce9727f69893adde9f944b2374843e602fba69811d11d93399da9da350fb9
d53f8f851ff83c23e7381844ea8366fda134819b78a9c7e1b906ce727ffb0bda
0a32d2d34c60e9376817d2be951c5bb4b35b78391c9d466aee51020b10cc96f4
0440b12b2965feb6ee205f87b124f41e00846556d7b6c060f5be22ac92318cd5
d953e7f93ee71444d7da6aa629ecc5ea463ef6d42b7d0d72cfdf210daeff51fb
8bdb76d576ef549cad918c9b3ea92118d5c3c638c98eca280ac6263f852c706d
0089fa82a88effc73051b27371bfa5721fa5cc794f0e4e4bf9f0b9d83d66aba8
e166c0e9bd962efa6d12ee4692d7bf26e0622b57d56c08dad9e95b3f27b2c8b6
087e7f370f4a253e574cf529776c81717fc21f2f1079a874cce935455e83b735
ad3d69fb243359c9f8d08b69624ef624cced39d9046936706ebf64adb3d953df
988fb9540b2fb9a36ffe5d6be533fb685af902e533fb5c90af69d0ab6a68dff9
d7d273247e567e31d519bf809c79e985532cb9e0d5db0539fd744ca2b8111f5b
78639b705ca3837252cc962bc36515994160b4518e4afb4500a50f4e38dbc56d
b721d0aa091dde7dfaf529ba827a7fb9989ed8bdcee6f714c53a999c3c6c4af7
SH256 hash:
2a318a00f9b00a40f13b40712eb333c515e9ae04d9c1d5719ed0514e1928a508
MD5 hash:
1286fb709af1a001e92b066d4abf8774
SHA1 hash:
cdbc20aefc102b8cffffefe13e9a1dfb0f6ebf14
Link:
https://www.unpac.me/results/16fc5f8a-e46d-448b-981d-a548cf393de3/
SH256 hash:
380a44854e0345f374203649bb796fd69469d174249d61891d2a550e311ba789
MD5 hash:
cb391628943071332b69d181cc6eae40
SHA1 hash:
ac10900be513618bc94619b07beadeb453f30aab
Link:
https://www.unpac.me/results/16fc5f8a-e46d-448b-981d-a548cf393de3/
SH256 hash:
4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e
MD5 hash:
4835fcb86507f776824633239c8b503f
SHA1 hash:
a634bc63dad946cd33d82ba5c3e167e491187971
Link:
https://www.unpac.me/results/16fc5f8a-e46d-448b-981d-a548cf393de3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4cada5bc9e82b93e8091da9301dce9aaf906115d7d130a40c96991ab2714d76e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments