Extracted

Extracted

Extracted

• • Target

    0f0c91e5d112ce1539ba6efceb153df3e232e1d092b743990f2b9661748337c4

  • Size

    1.3MB

  • MD5

    190a460dc66cc3354324521ad308aa11

  • SHA1

    7ba615806bbacb0d5c79b61997e6e9b5d32a7f11

  • SHA256

    0f0c91e5d112ce1539ba6efceb153df3e232e1d092b743990f2b9661748337c4

  • SHA512

    c6d2db4c3303c22a17e6c9566171ca25c46ff355dd7ee702e71a6e201b9696ad71717b3789536316e9aab2e3920dea0ffb8c05aaae02867c3d1dceda380c9ed0

  • SSDEEP

    24576:/yplttToR0bc6/xwbVoTabXrNnYdbDAyFyitDcNWa1534X+YaIuNE4mCu:KvtmRq9MCYYdXAO7tEoOe

  Score

  10^/10

  amadeyredlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1