Extracted

Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    939KB

  • MD5

    f86ec63968d593f86e839cdb0f9a3839

  • SHA1

    c124b43ab34b6cbc21f46275e082488409f0879d

  • SHA256

    cbccf7a6e6344eb5c5501a0debbe74462c8b38617b8e17b832d88985e9c4f184

  • SHA512

    5417e6cf46cca5377f1c5de32652a7d1255cca29a6a3ed280ab8eea0d1a58b7143de407615b658d5a5b980e4e8fe8406ec83ebe530691bdda73406e756ba0771

  • SSDEEP

    12288:4Mr4y90pdYYHb/betMxNlDY7USIo+Rrrc/ejgszfzMnBzidXx0zsUY+dEqgUd0NW:Ayydh+GPO+hrBjgs3MnBzXMqFd0NT6

  Score

  10^/10

  amadeyredlineckdubkarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2