Extracted

Extracted

Extracted

• • Target

    e68accfec9356e006e37e652d1f9061d82d1f00670b9d029b32a4ceba67fa900

  • Size

    246KB

  • MD5

    d97676c845137efe4c44586ab8db7bf6

  • SHA1

    d254580d33e716a83f12130cc3adf6efeebf7d13

  • SHA256

    e68accfec9356e006e37e652d1f9061d82d1f00670b9d029b32a4ceba67fa900

  • SHA512

    18f774b6615fb4858014009e1dfbeb657d2f24703861ff9db28d70cddaf64c0a926a7153a3077b4f3ee131c2f694af3321abb270c8cf0e314c68d3f8ba2bff61

  • SSDEEP

    3072:ssMHbbVC9QYGE4LvZDjsn2nM5ykfIcU4vaSNb5qjJ8Fe4t2QhpG9tWsWhJ4dLMAn:sHtrLvZDjZPSIcUUqit2Qhw9q4JNn

  Score

  10^/10

  amadeyraccoonredline16465d0e7bfd19684d4e56a43306c91britchshitinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2