Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    724KB

  • MD5

    7df72bb1f975808bdbed3492142bc6e6

  • SHA1

    a4de51dbcfe3128bcec0f2c2d2ff541949ef42f3

  • SHA256

    e52a728445980bbefc1bab5d135628ff57196f2e65b9dfd3c990705d7bd6b4ab

  • SHA512

    bcafcc49badcc7abc7f127d725725b2997b96897fadf96cb057c0da89fa0d44b75323f62ee9f83ee57c9038ecea384897ddad6b215703ccd7dd2caefdb0a52a7

  • SSDEEP

    12288:GMrZy90SKJmVcoTyY55RKIvO0/KBssB54JxeJrLVde6k6ZW4SVyZRlI:vyzVwQ5RHvO45SrRf1ZWV0I

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2