Extracted

Extracted

Extracted

• • Target
    file.exe
  • Size 291KB
  • SHA256 6b79f46697a2daa7bc7b10b8cb0a92b3e2fab532e33cde35e7cbd7a63e26b84c
  • MD5 30c75ddeae7315575adad82d75ab6e11
  • SHA1 43073f8e83614eb0e82ff3b706ba70dc933fa294
  • SHA512 454889a25624acf78372b7a6b9924c8831c1fae7350faccef900927ea91db5340f9a8071be8f6ca7dd14399041ecaefe4cafd3e3206287c7b8b7d9768c4ded80
  • SSDEEP 6144:Hdi3tL3INzqT7ETzL021NdL6K0tYFqJcSDuLTT6o:HdidTINzqT7Er02bD0tIqWSDu3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlinesilaupadated.1.223.4.5collectiondiscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2