Extracted

Extracted

• • Target

    5b2fdeed792a48f934ec70eef7746ff8b476b52c11f5638c2462081fda979e13

  • Size

    726KB

  • MD5

    4ee75ac3e96665481b677e96ad4fc6cf

  • SHA1

    5e811c1aa930bd5433275b5749e44f0e3f496fe0

  • SHA256

    5b2fdeed792a48f934ec70eef7746ff8b476b52c11f5638c2462081fda979e13

  • SHA512

    3bca08ee42a5f05b409bb86af2eac601f77ecf527f65d5b8b5649a1e8042f56ed88b18b29cc6fa183f6be607812b536dddc167d685793a599a84c67c42879470

  • SSDEEP

    12288:VMr9y90kC+jNF2FdBzjhFs44QEOZQeJeLT9VXK3KRRe3tPD6Qu21GlKd9:0ygiIbjhFz4QEaXRP+QuK+69

  Score

  10^/10

  amadeyredlinedunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1