Extracted

Extracted

Extracted

• • Target

    dd7ddcf438ed71f7eedd7fd48de6e7ea2f6ed03f70650d4ded7e961b26072dee

  • Size

    873KB

  • MD5

    83135212d7241c1de585d6d64e7cae7d

  • SHA1

    da361a3dcb7e87aa645c7d818c885f20a0db103b

  • SHA256

    dd7ddcf438ed71f7eedd7fd48de6e7ea2f6ed03f70650d4ded7e961b26072dee

  • SHA512

    7d89957467334499cd1732da5d37c595489784f0d01de61322dfc637705412a4cf601f466037aab2c2ac3b5eb6935665de8c43288c2290b08635c6bb4b34140d

  • SSDEEP

    12288:zMr9y90kowyPOya2HMi9IQl5HstY7slU08ZMa0/Q4INCh/5nKFoCrqmvXGrG:+yRowP4HMiVHsSIK+aVNc/MgmPGrG

  Score

  10^/10

  amadeyredlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1