Extracted

Extracted

• • Target

    3775123171340148c390234d05b64cb08f47d2fdbdf8e6548feabad3ce4b9af9

  • Size

    714KB

  • MD5

    4998d8f709c378014d65a94f7ec00466

  • SHA1

    d3168c0fcb8ca61bef715347c579585541cf8dd1

  • SHA256

    3775123171340148c390234d05b64cb08f47d2fdbdf8e6548feabad3ce4b9af9

  • SHA512

    03970e7da767ebd9467db4e615fb8b89ef0929fa7618789631d0da24dfdbbefdcad286b19745cd106c1de51a38f05af64a9f0377e6abea67698af5aac26e03da

  • SSDEEP

    12288:1Mrry90yhHi25+XQOEPDDHI5kesIIFj4WVLcdzTt+83Fl3B:qyVHi25+SPnI5kq9WlUTdFlR

  Score

  10^/10

  amadeyredlinedubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1