Extracted

Extracted

Extracted

• • Target

    470138ea67a6aafb0059bd41949d7052a9b9b3fef615acd880c6c29df3db083e

  • Size

    244KB

  • MD5

    0906eebf6f5fd1f9029e4bc6f81a636d

  • SHA1

    938df93f0f7ebb8f31a2d2e57c2447d17a0737b8

  • SHA256

    470138ea67a6aafb0059bd41949d7052a9b9b3fef615acd880c6c29df3db083e

  • SHA512

    dad5fbcb96ebfb5c29d3fc3f46528ad46dce70acd67ee257b288ad58224117f90919ebce2693b4df9db7ba86f79fa417ff6b6b21c27a837e4d36d7c2b8ef7af6

  • SSDEEP

    6144:wuh1kLkzOqq8CW1V8Hcc9JOkbztWp4vW677CNZwVLL:wuh1kxqq8HrIDvHfCNW

  Score

  10^/10

  amadeynetwireredline@redlinevip cloud (tg: @fatherofcarders)botnetdiscoveryinfostealerpersistenceratspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2