Extracted

Extracted

• • Target

    51c7358c5391fa70365262ccf96b1b4d79f30773f7afd1f5586e221461c36003

  • Size

    642KB

  • MD5

    3e50595799f125b7bbe03c44f519b92e

  • SHA1

    a8c440f2b8c81464be63b93290828bbc0b5b555b

  • SHA256

    51c7358c5391fa70365262ccf96b1b4d79f30773f7afd1f5586e221461c36003

  • SHA512

    eef4b912f350148d3dfd8ee2194b7623b5a9dc85ff09bde83f6abedf86d7bc03168e074a52c8e20098a2e7010aea33816f9376964a5c6ba1b32aa6d6276a0eff

  • SSDEEP

    12288:FMr+y90bgcCMsye5pZ1bkSauq8wWo+Xb8KMY7jb:/ygtCMHeDZ1bVaIwbqhjb

  Score

  10^/10

  amadeyredlinebiloddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1