Extracted

Extracted

• • Target

    6d82f975be0abbbcba5d647eb30bdfb638a1e4cc95d9f3e98145798a6d4703d1

  • Size

    465KB

  • MD5

    01cbe633e81f624b06f1cdc474ff5b24

  • SHA1

    44fcbe76e59f8b60a7943adddeec28b0567f49a0

  • SHA256

    6d82f975be0abbbcba5d647eb30bdfb638a1e4cc95d9f3e98145798a6d4703d1

  • SHA512

    63e298f4c18d50a04ab36278a43dbd123be2b8996cfadf4a0ba298a9a20f28a347afc371c98e7714d22eea58da0b40487928801f42ea1c8cf63803fa87987104

  • SSDEEP

    6144:WYFpyHi0jvNVGnNMDLTxqQFVXM7ABMFn8/nYdeoozd8uEkeKUoqzVPE:lYHi0TT46TxqQXhE8/Yde1yhKxSE

  Score

  10^/10

  amadeyredlinedezikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1