Extracted

Extracted

• • Target

    67bfd0a0ec759ce4bad8b537f69a86735bd81b8ffc0251a77c7c06132f99a5d6

  • Size

    725KB

  • MD5

    21d14bd91cc50b58f1f9c9898a547102

  • SHA1

    03ddba55b9051ecaf1a04c5842aa06acad8267f0

  • SHA256

    67bfd0a0ec759ce4bad8b537f69a86735bd81b8ffc0251a77c7c06132f99a5d6

  • SHA512

    935f3d79c08f7738aebdf1b671e6f17e0c09fcd2aed74e43cc1aa2a2222e58f8b0e40d867ed9d0196ceb7d6a08e3327849870b1b9d10de365dd9763b00fc1bf5

  • SSDEEP

    12288:QMr6y90raoMIvsQOBsWcKblXLDZm/JIROVBO7Li6TAfaIpjsBjOsxBjkjDVdKCt:6yEjMIU1x/bdL9m/awiH6fdjE4VdK6

  Score

  10^/10

  amadeyredlinefukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1