Extracted

Extracted

• • Target

    file.exe

  • Size

    740KB

  • MD5

    fa32f10b7a6934543bbebba52c297b3b

  • SHA1

    dec6e79fb334c7d53000c2b2731e0ea7693f69dc

  • SHA256

    23847d735b899cd73b2af1a02bd9eef81aa341dc599157c3014bf38c687a6410

  • SHA512

    0c61405adf2648357abc0bd62392e240afe69bf3dede2375a728a10744e24237987ee4fbdf6abfac7a3faa4ca2af6f9594932060588468a9c7fef20904f41636

  • SSDEEP

    12288:hMr6y90VF9ISwY10/66w3qzTfdToEl0Ajn2RLY6mRDBU/rwslYEboVM1zrrBS:3y8ISwY10Cj3QT9oESEn5+/rGQRE

  Score

  10^/10

  amadeyredlinedunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2