Extracted

Extracted

• • Target

    d6cf7eb2f2bce5fdf802196afe5a39c8491f0bb6923f5a44d0fce50ea97c8c35

  • Size

    465KB

  • MD5

    2983ae6f5c1595f33a4b3918e8380c15

  • SHA1

    fefb997b9296dcb62878ba6d24be0f7aca70e1cb

  • SHA256

    d6cf7eb2f2bce5fdf802196afe5a39c8491f0bb6923f5a44d0fce50ea97c8c35

  • SHA512

    e41b85727f81eb26f5a5100592160fb63369abf7841b1600464fe37f55a631240e5a4cc83dfc81d180a1b77af36185c0b9e12e28a41aeb1674991540c40dc315

  • SSDEEP

    12288:lIL0AfYZZ/HlFdHh8oegI6tEFbQF6QvyZk:ll5ZZ/TphlIeEF8b

  Score

  10^/10

  amadeyredlinedezikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1