Extracted

• • Target
    file.exe
  • Size 319KB
  • SHA256 54e4e5c18704b1905e9bb7906c42937d9ab8005e092cfffeadc7324beb8e4161
  • MD5 5233e20235c8c2089139eed3c524f56f
  • SHA1 49f5ef3eab7f9bb239da40d8a23e79088d6042e0
  • SHA512 a61fed4c9240231480b7953cb508290779551df39f9a2d15c002e0ea2a4003dbe3ed681a7f62539e92d6da3e26c188d2bb45816cb79f7fc42670d02b6d2a012b
  • SSDEEP 6144:9UTrfLCyMghDlBmVIGk6uN4bY2rayTPKrC2h7ITsq:9UP5NhDXaTkRN4ray+r9h7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlinemukacollectioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2