Extracted

Extracted

Extracted

• • Target

    3e8315e58c0abe710000c0ac3156cd235a5c81bf4b115eef82de089ed29661fc

  • Size

    1.3MB

  • MD5

    288cb7304273592dfc9aa4a4d8020e19

  • SHA1

    1b8fd171d5240eb01318ab9a11364bbdbf96c7c3

  • SHA256

    3e8315e58c0abe710000c0ac3156cd235a5c81bf4b115eef82de089ed29661fc

  • SHA512

    ad052ade26b719781036498f55327ddcd601505e1b8bfd3824e598e3ae412524233923dc5c48238dfff9f457c48bbeb24d4e1d7dcdd69cf4dd035e8f2b213dbd

  • SSDEEP

    24576:GyZuEiN/R/JM3KEvcU35e3edpkdIjPx5wNZrDp3cklnivO:VZ6N/1q6DU+eTkcY3pMk1a

  Score

  10^/10

  amadeyredlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1