Extracted

Extracted

• • Target

    32ffc42efc44eab9be45965aefc1e6207db387690f00dff10a25b3b2a6cc765f

  • Size

    796KB

  • MD5

    9e8d11681ebdd084702e544a34693445

  • SHA1

    9ef6a1c1642d14c2eba42258282ae32c9a6d1475

  • SHA256

    32ffc42efc44eab9be45965aefc1e6207db387690f00dff10a25b3b2a6cc765f

  • SHA512

    015b32490a0b4043c57b01720eac81a6f7746bb1eb5020034a3a1cb691ccc1161e87e2b380d3943a4d8138e09da20b520f55ee6b98cc6510ce3f3eae797c1b57

  • SSDEEP

    24576:wyucKpzeViO/XOIvGto88o1HI1WvXUUzr9DEKF:3bwe8sXOIvGto88oNZvr/xEK

  Score

  10^/10

  amadeyredlinefusadiscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1