Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    1.1MB

  • MD5

    2506161ece562ba3ee476ce12d1bcec2

  • SHA1

    031bf3b130cf25b3c3a48b2e7de1c7e867254d5b

  • SHA256

    f7f4b9e876897503a2c2b4f8112b4ef19ec4ade9b98e0df7358bb63ebd6102b7

  • SHA512

    d5f633c53d7b33b8877fdf853bf29628801de1ee93282a425820e15987d02698c31bda2631167a76ce500b3a1ff542828adf0ad9b5009a82dc3aaf5975d64ad5

  • SSDEEP

    24576:cy8ATUwMi51bs7NyKOoa1hXH7HicJryH3ooelM:L8AYwzbSrOHN98ooe

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2