Extracted

Extracted

• • Target

    7214a52a0106c9bfb1e7c69516eb51ee96f67990501dd9de1a5dee9770670e70

  • Size

    690KB

  • MD5

    ae6e74bcbdce4922e552d6c6b193fa44

  • SHA1

    d060f11e20db10aded493576175b22a5e57d6b08

  • SHA256

    7214a52a0106c9bfb1e7c69516eb51ee96f67990501dd9de1a5dee9770670e70

  • SHA512

    4a5548363b89fcfb5e27a8ad19f580a3a59281303259509722faaf9187f1baea4de8e9828c5fc69a93835fbeb7a7963ddba926920ae2509c9120f795f6981861

  • SSDEEP

    12288:CMrSy90rAjQa0FG9yiJ8kIgrwwECSDGxLHqthexBtqA09ABmlQ79cWQtyRgvP92q:0ypr0F03J8YwZ3D8HN7tRXmG7yMgvP9/

  Score

  10^/10

  amadeyredlinefabiodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1