Extracted

Extracted

• • Target

    5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3

  • Size

    465KB

  • MD5

    2fe73d3c6c730a42ee1f68154ca6d479

  • SHA1

    2698702d66e280668c9a25b27ce266e5b09d8a47

  • SHA256

    5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3

  • SHA512

    f702860df1cd22cca785ddc070c01784a3e463406148b1ee16cd43f0370ed6b5f4172124d8dc94ca2a64e1d0024bf1ed03a67abaf594c8447428f15a7dd8f28c

  • SSDEEP

    6144:zFe2WskQALI6KzqjJLKLFCA0k4JzFZUDadKOCRTQoqz6:RxWskQ16UqjJaj74JRCDanCRTQoR

  Score

  10^/10

  amadeyredlinedezikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1