Extracted

Extracted

Extracted

• • Target

    6bad03acaabfc7d3f2f184b7294a3276.exe

  • Size

    720KB

  • MD5

    6bad03acaabfc7d3f2f184b7294a3276

  • SHA1

    c945cd3a5479c3f47b0e15df2b754b6b12694cde

  • SHA256

    b531e677068b29e1b6488e004d3a66d51170e92ffbaee87af76726d74e5444c5

  • SHA512

    70eb65309a66442a7f01c32e10169ee7ee1d7f2aa42b4d34fc77ac8022111bf3531ae400e5966da7501ad2b6340032f8295394664a1819fa57b17f1baef15bf9

  • SSDEEP

    12288:vMrfy902/lVbBVD5gXiOs9AwZaD00zkR7ZTZys/3aeCPv1ZNaGH/AGWWzHX27IUB:gyN/lVNVlgXiOwaD0tZguU7rfNlI

  Score

  10^/10

  amadeyredlinefukiarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2