Extracted

Extracted

Extracted

• • Target

    99f13bda1fef34468cc3bb954f715af6dd8cc334afd6cc1c25ae8e8d57e8a8c5

  • Size

    717KB

  • MD5

    5f6cb4b4c68dff87d2f154a587509577

  • SHA1

    93752ad2464b0c1d2a0f1d5000aef50317a9bad7

  • SHA256

    99f13bda1fef34468cc3bb954f715af6dd8cc334afd6cc1c25ae8e8d57e8a8c5

  • SHA512

    7dd45ee9df70b9decdfd07854b4e08909eaaf9462bd582cf97367eeb721f5c9247723bea87e20e6163a1059c9938a90ed9a0acfd7b337d4fc5a7295137478ae0

  • SSDEEP

    12288:2Mrpy90V3qJVgftNXGFjwBhiYqKeJ4j/FKu8B/uZcD1BHipSBv+qspF:Hyo3qJV+rXa8Pm4bc7luuvHgJqMF

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1