Extracted

Extracted

• • Target

    81fd07d91a0c3d7097e6f1bb0e875303a4386e8fa61b2642556f62bf9ca07f35

  • Size

    857KB

  • MD5

    10c0d2f349685582357d4af9abf2701e

  • SHA1

    9e1d18998cc5ba6687ac5daf05b759d5c949f7de

  • SHA256

    81fd07d91a0c3d7097e6f1bb0e875303a4386e8fa61b2642556f62bf9ca07f35

  • SHA512

    566389aa3b64167de1c0cfe389c7eb6d50259ea7a0a3eaac1f715ca7328ef01d68d90de92a963211168e4be56f0b67700aea58faf57f573d5f76ef9111a6d97d

  • SSDEEP

    12288:gMr+y90Bln7CA5CXpRsIXe8d5k44qnP32aMR7XmfA0LS3ED+Lzzdxcakp:uyIlnumCk2e8d5JnPy7WhS3ED+LnrA

  Score

  10^/10

  amadeyredlineruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1