Extracted

Extracted

Extracted

• • Target

    88ba56a4d296947adfa7ed13f3dc4e364c911aef2ae708adff3c723916bfb145

  • Size

    1.3MB

  • MD5

    16e134ab43d4f6c60bbffc46b0ede69e

  • SHA1

    aabac1e6fa96cf12076e933468c1bc17817015a0

  • SHA256

    88ba56a4d296947adfa7ed13f3dc4e364c911aef2ae708adff3c723916bfb145

  • SHA512

    0251932d4a509b8220ed580811234f794305dbabe29ab34bd24775c5bab9c46b0f6a49e838ff9be00b9a83004ac0d196f6f8fe998c081c933f025c0bd4c2efe2

  • SSDEEP

    24576:qyBtVuWwQ/Z257B0hmNK1OHxWaLksxnClYk0EPsdTPDI5TnbWlh3mfj2ZiYC:xBzuN+2572raLn0lYk0EPcDIJa3oj2Zi

  Score

  10^/10

  amadeyredlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1