Extracted

Extracted

• • Target

    b6827fc2c1beea50c7cff5cba9e607fcbfcda874a711c9b4a66ac665e1ffa69f

  • Size

    728KB

  • MD5

    7584be6252e12811b2115b80a7237348

  • SHA1

    7d15dd8b520ccc94a048cb0ed233abfca6112fa1

  • SHA256

    b6827fc2c1beea50c7cff5cba9e607fcbfcda874a711c9b4a66ac665e1ffa69f

  • SHA512

    a706cd6c64d01637dfe8235addff999a345b76b4898a95b9b9eb3b1638fed5b7f13ce9ac1773cec07484dd1171aace43762612245cbba742e31e7699c6cba8f1

  • SSDEEP

    12288:yMr6y90Az0STlWmVt+9o+5rAZljpZdWPzKqhIzDQeJCF6OZ2dZgxMJUnt47YFzLN:wyX0yPVK5rAfjpZ07FhIViZ2dZO0E47G

  Score

  10^/10

  amadeyredlinedunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1