Extracted

Extracted

Extracted

• • Target

    28db02b7d3597fe78b61868c211761309b742a8ec9257c1c2bafaaab051235d9.exe

  • Size

    722KB

  • MD5

    b8cbe1a0f4b022446d865f5d63484e21

  • SHA1

    1e1487bf69281ed93652b3342e5e55ad0df7b267

  • SHA256

    28db02b7d3597fe78b61868c211761309b742a8ec9257c1c2bafaaab051235d9

  • SHA512

    6424b8e974b7842110cf136f3c13a7feb3e08f67bd0c93b81c1b15ed65c05a80145f157959a176003865900e124a27d0b7c978f3d6b4432e504f4ec1ee215991

  • SSDEEP

    12288:FMrcy90oUYaiysNjREg8V+XsgMETSCrwGBMD537859mS/CGLSdrRxpLrm5TG:RybGiyYRErV+XME3wGuDd78vBSdVa5TG

  Score

  10^/10

  amadeyredlinefukiarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2