Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    724KB

  • MD5

    4b49cf66891946bfc7a26cb9dccc2bf6

  • SHA1

    beb3853442242bc3d0d87f6c6d48103f64519316

  • SHA256

    5bf42229296a3563062d742c126b9ae2c104e186dab00ed3290c9de0a1ba8113

  • SHA512

    ec57f8c0352dca32f020872752adc802790ab7db4ca32cc7fc3938051d4764401ba0bb6d1a55c3d52b9cc8f36f614f188fb1fb950c7117f0698c543632b3c3ab

  • SSDEEP

    12288:DMrty90pqRbXxPSLpD5fG5u0tqt3teJRlkUcaTzENhpC5NkUE:SyoMhPSLpD5fG808t+fNZTINhbUE

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2