Extracted

Extracted

Extracted

• • Target

    a7f60f90697ed9a34887a4eb4aeb2bf13ebd732ea0d7f52961bb58101f747b29

  • Size

    724KB

  • MD5

    dbc9cc45f9009fe151bdeae3f842a413

  • SHA1

    1bd492a48fe4aab9a80d03d54fa7609e4ff7807c

  • SHA256

    a7f60f90697ed9a34887a4eb4aeb2bf13ebd732ea0d7f52961bb58101f747b29

  • SHA512

    2ca80cb4f8e1463a17a383efe6c25e4510521b1d4747840e06ff167d97eca11ec5912b885d4f2b3ee9c375bcd87d75c817dc813248c0933c447b0ba26d285eda

  • SSDEEP

    12288:BMr4py90uAMX7d1AZL89t416F+188Zg8IPRO9T1WQy+e5tSGRGbiq/2:5pylAMrcpE+/88Zg8IZOjWQy+eCGRGWd

  Score

  10^/10

  amadeyredlinefusaromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1