Extracted

Extracted

• • Target

    f4776df71ae7691cc1aa795c65b8d47bfaf6b7d9dc1bddd08ac7f64d6d2f3532

  • Size

    259KB

  • MD5

    8db2aa4a8487af88c6484945e6b16035

  • SHA1

    f5e55e81021d947d417936c949ecbc20c86a444c

  • SHA256

    f4776df71ae7691cc1aa795c65b8d47bfaf6b7d9dc1bddd08ac7f64d6d2f3532

  • SHA512

    4fb92cb8b550c7ef31dcdb87bfbad2c4c119ad8dee9e116c4fe2abf77894d4eed38394b4aabd0bc79df6901a3b1ba750075d152f68b99a93d8a7e68b9597cc9f

  • SSDEEP

    6144:mpnHBLAWoOQzqDrNvYUhC80sPChgxtuVp:mpnHByBzepvzhC80s6hiEVp

  Score

  10^/10

  amadeyredlinegoogle2slovarik15btcinfostealerspywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1