Extracted

Extracted

Extracted

• • Target

    c621995ef999ddffd73a64495cbd1e1d06318f6a47c584fc5b25d5569327af48

  • Size

    244KB

  • MD5

    1a02333a68627b713ff9509041748b0b

  • SHA1

    a7cf4ab401588dd9b54b891e3acb7507543feab9

  • SHA256

    c621995ef999ddffd73a64495cbd1e1d06318f6a47c584fc5b25d5569327af48

  • SHA512

    ea8827e5ab7feb952b13a4be11c6b80e4719f657c8f27b0b2c13269665045d64a4ade4661da08fd86eedced0abd9b3e99bbd92a3ad2a92dc039503893b1aadd5

  • SSDEEP

    3072:5GkpuBFYSLE+wWRco5BQlMIdK4lE/FRPttJqLKF/+7F0JNkPZWF1hU:0k2LE+wi8lMkKqENxtLqL8UQkhW/hU

  Score

  10^/10

  amadeyredline@redlinevip cloud (tg: @fatherofcarders)variant01discoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2