Extracted

Extracted

• • Target

    5c7c3a820bb1e22674eb6c75a0fa3bc0a9d236bf59962c9de140c07a5124528c.exe

  • Size

    716KB

  • MD5

    72fcd2c817dcac50b6ae2e26cc392508

  • SHA1

    33f0ddf4b3e3360a4c4943dfc6398ed77eca991e

  • SHA256

    5c7c3a820bb1e22674eb6c75a0fa3bc0a9d236bf59962c9de140c07a5124528c

  • SHA512

    aa34c2964668bd7bc3abab780fedec05d98fcc72fcf32afa0ec53ef8542c08390b8f0f0c0ddfba4d56323224c34939a87fb5cbb99fe397dc3de3c16b4f8b437f

  • SSDEEP

    12288:KkQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:44MnHJ9JK3TtReMa8r0U5iyfkNW

  Score

  10^/10

  amadeyredlinedezikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2