Extracted

Extracted

Extracted

• • Target

    a321252d42b08d08718d2fba98e4850781d16292e6c872cc9492f45b97414e9f

  • Size

    1.3MB

  • MD5

    4e92a89e28461891a3d8f047f793bc9a

  • SHA1

    fb9e0626097eecbd844ac985650ae23cc0dc997f

  • SHA256

    a321252d42b08d08718d2fba98e4850781d16292e6c872cc9492f45b97414e9f

  • SHA512

    5e5179c513f31172a95c71f7d46dbd4d81d3d2356515e1b4ae9e19f1364d9ac622dcb41352183ebda23258d5b4cc6a828736fc4f7e8af1c7b30aecd28154b9b9

  • SSDEEP

    24576:eyaB8s9V9vET5f9B+rkRqn5mfCBpasvQRF7eZ8g/dP0RpkNbkTnTSY+:t+D9Pv+9sQUn5mfCpdQT788OdPIp2kTT

  Score

  10^/10

  amadeyredlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1