Extracted

Extracted

Extracted

• • Target

    6a15ff2867cb0ec43d7f082a8b2d0c91f932403df84eee8dd56ac0f538848002

  • Size

    1.4MB

  • MD5

    7a2e71a96335b24792985c095814e06d

  • SHA1

    0707752e093590bbd192649146a892e008179f0a

  • SHA256

    6a15ff2867cb0ec43d7f082a8b2d0c91f932403df84eee8dd56ac0f538848002

  • SHA512

    297b236c952ea757778f2fcecd32d7068717a198f2fc67ac01676b22a6e84ce0b77b594c2df57c9247f50306a6b3bfad7d211b41b92f8fea19885155c7a14eb2

  • SSDEEP

    24576:Xyo8pt7JVCtkdW7GaTWk1Ej9HY2bVumErU2k46HSzPI3T3B:io8pVup71T3wHXb9y5JzPw

  Score

  10^/10

  amadeyredlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1