Extracted

Extracted

Extracted

• • Target

    2c47a0a15dad1c10db417b6f8e173e860948b1b101d895e9b50c66ae90df7f46

  • Size

    1.3MB

  • MD5

    0acc22534912c05783b1278ba9e17bb7

  • SHA1

    a19974747e0aa3c5662d42458b9af534f975d884

  • SHA256

    2c47a0a15dad1c10db417b6f8e173e860948b1b101d895e9b50c66ae90df7f46

  • SHA512

    267f49683c13165e8261ca6e1d69ef3e71926ae984514c5c440a46faef24284dd30bdbfb7cf3006dc488ed6dcb768f84c9d3afa380bfe6f89eb21d5a285b7759

  • SSDEEP

    24576:JyfoWinXR4tvkZPvb8hyQnJZMP3jGAf0gI8DR72KcXjsSfn1sBGI:8fninBmMocc7MLGAf0nc2Xjl1mG

  Score

  10^/10

  amadeyredlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1