Extracted

Extracted

• • Target

    84e2d16c2a59ee5126304e03dbb630c129b5c70843da5aeda55f7a4e3704dabc

  • Size

    465KB

  • MD5

    7764155e2f41d719ef29f24e0a09a57a

  • SHA1

    52bd43d3039aa7e13e8b82640a4c555f3611cb61

  • SHA256

    84e2d16c2a59ee5126304e03dbb630c129b5c70843da5aeda55f7a4e3704dabc

  • SHA512

    a7df43e2a7875bc98edef1db98dcf391bd33314823cac6739d946855f4ed2b8b5c9dd278afa55d4e11a633dc1f3712ebf35cfe05439b6d45c0ba6bcf8a13d163

  • SSDEEP

    12288:L+7cqN+YPcgStCU1p+XefP3zCtLcZG8S:LZvYPcgnU1p+O3K5

  Score

  10^/10

  amadeyredlinedezikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1