Extracted

Extracted

• • Target

    8074a8ce6428033c1a92e00369918106d7768e92e0a565efa2913d5c15a58eb7

  • Size

    728KB

  • MD5

    846d2fa53f65144406f20690d3833e33

  • SHA1

    6b18fc71bbed12859e2cfe4847066cd3a26c8d15

  • SHA256

    8074a8ce6428033c1a92e00369918106d7768e92e0a565efa2913d5c15a58eb7

  • SHA512

    60eb172b2cf13b769d385666390c4124f2e926f4d5085edba098ba27f788b39986b7fa5ee77cc8e979e40eed391938a9a8617d6659536c38d451ffd8a872e05d

  • SSDEEP

    12288:3MrOy908PpQKRJA4zWpSzDlpx/as0CreJeEMaWdzoeUQt4PtlSfjfHs:Ny9pQKPt3has4eEZWdke14PtlQfM

  Score

  10^/10

  amadeyredlinedunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1