Extracted

Extracted

• • Target

    c75bab2c86b7b5056c46b87ada43d74b877404b41f296785ca898c9f31618d22

  • Size

    742KB

  • MD5

    c09cb9624c912e0ebd1d8f07e3ab5eca

  • SHA1

    42fd45dac61e34e4574500e3e6db865f49463cbf

  • SHA256

    c75bab2c86b7b5056c46b87ada43d74b877404b41f296785ca898c9f31618d22

  • SHA512

    66c72338478b016faa93e4c3de1a916c2bc54e0bbbe3a192c9666e41cdfe49bda1a5e9114775ff3d31e4210e9cdbb62b1e9ee70c5554995f7c01e9b4147032cc

  • SSDEEP

    12288:iMrsy90TB8egnkXzi9uBTQxMHDJKH/LD/miadtvZUoRU6IkITH/Bkii57:yysB8dCyETIDih6oRU6IFM7

  Score

  10^/10

  amadeyredlinefukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1