Extracted

Extracted

Extracted

• • Target

    7c6298c7cbd6722f9fa5fe36fac68ea5db5f7cfee5978a385e963a2a3a6d5ef0

  • Size

    723KB

  • MD5

    d94f290aa59f7c24d03a97d67a4ccf59

  • SHA1

    a5db03e1e36650673a32eb71fc71b32c83c066e5

  • SHA256

    7c6298c7cbd6722f9fa5fe36fac68ea5db5f7cfee5978a385e963a2a3a6d5ef0

  • SHA512

    5074ff2148614512aa1af50d944ca7dca8ac8a5aadec6b20f1ea4fce4d3281e6193aefc5a71fa2425e2bb83bf63175b1270f524ac174db51873d9eb2cd6c1b13

  • SSDEEP

    12288:FMrfy90cOfWQL7E4RhVltEZHMSnx48889Z2IPq24RTFpB38x8zzRfAmVp:CypZ8XV/gHlnl889Z2Ii2QsyzRIw

  Score

  10^/10

  amadeyredlinefusaromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1