Extracted

Extracted

Extracted

• • Target

    56ee213b336ed1724659b7ac1e42dde95e932636f7a5346821b9ed368e82cc07

  • Size

    724KB

  • MD5

    75891aed1d1784631d74c4617551dff9

  • SHA1

    cbc17f29fad9391a490b7bbe8a2d682de1de88c1

  • SHA256

    56ee213b336ed1724659b7ac1e42dde95e932636f7a5346821b9ed368e82cc07

  • SHA512

    466eef6e1963496b5dc874dd03585b6dc0490796d2a5660637101a8112d7ec6cc85403b3dce2424d54820c2467094cf00664a83cd01dd5e2f19b3fd73f00c219

  • SSDEEP

    12288:MMrUy90XiwVdZUq+H69LPikYrhzAk4eJiIGawyqesKdpcnv45GkMGCz:wyybVt+aJ4FzVOZyGr

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1