Extracted

Extracted

• • Target

    8de55f21898f5209b71034c28d64d4c7f77b38fd4219daf259e67d214ce69da0

  • Size

    873KB

  • MD5

    dad20f4aaf773a28df646aca2cb9c70f

  • SHA1

    3474157cf52584e43b8fc64f1d38641c495de3f6

  • SHA256

    8de55f21898f5209b71034c28d64d4c7f77b38fd4219daf259e67d214ce69da0

  • SHA512

    f231f5419f161a13937c98f978f3737d8eef0da1f84d3acc318a27cc56bd04b4e07bd19f4c5cd494930dc569c6193fd756a93dcaf39fef6ceccbb52b2e638070

  • SSDEEP

    24576:Ty8VCMCAliwQa94s+h+Lw0htYy/gcTG7702tI0:m8ozAU8qsf/hTG302tI

  Score

  10^/10

  amadeyredlinerostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1