Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    728KB

  • MD5

    179fa0e337be1fb6f9d9149f278c6a8f

  • SHA1

    195c60228bc97cc02a68a50b537f1d631cd712d6

  • SHA256

    b54f695ab656d79ccd86e01583a6aaff765285b4d499739cccfe7f371ef701e4

  • SHA512

    7eb567b49ab9ba5d62261c3ed480b0ec63a46f607b479460b24dba7537f90a8e24d3cfc6fab97de1276ef3a1e318517ee7d8f4b2ef7f4cca850744e68ad049ef

  • SSDEEP

    12288:CMrny90/iRzXDfk0X6wCMbTfJ1RlYE268eJz1dMi85qefi3Nzx:Fynnk0XwIjJ1kgJdMi8Ysi1x

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2