Extracted

Extracted

• • Target

    76245e66bd06d2b8f3e337aa9364fba846826d51b3f76f32f0fcfaf7ac0ec196

  • Size

    725KB

  • MD5

    e9e25f9c4555104716dec3c4fc9d3f5d

  • SHA1

    24306bfef6cc7e54401c4be1697a7797fefa2b10

  • SHA256

    76245e66bd06d2b8f3e337aa9364fba846826d51b3f76f32f0fcfaf7ac0ec196

  • SHA512

    f7b2e432081bce6b8597c2e4ca568f602427cf5da27a843aafbf28132885eaff4ffe0a1d578d2f771a1692cb526b6ef46c22d179def914f412543843c2d8dedd

  • SSDEEP

    12288:6Mrey906HXoTDBGnjQ7j5QyK0e3MUDIgO/oYvDwDJoLI2BXQezQ/tAu/Ug47Ig8:4yFAcnEuj0+M+IgO/oYvDwdo021Qeklt

  Score

  10^/10

  amadeyredlinefukiadiscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1