Extracted

Extracted

• • Target

    0fb541e029e8e6101dda30f9aa8b1d7655007dcc320ef3f942a00452c2ac0802

  • Size

    459KB

  • MD5

    4c5e41cc602f7987dc42265c73626f72

  • SHA1

    56a167e91f14e5c8c7fdff8006b264d6fc6136c7

  • SHA256

    0fb541e029e8e6101dda30f9aa8b1d7655007dcc320ef3f942a00452c2ac0802

  • SHA512

    19d13f81aa4dc130f9d30fa6b239e1bab5343418a3d096417ec13858645f9cc5bc881d271b7231aa4e705ea5951bc6b3943f5581289423077581abbdfc407664

  • SSDEEP

    12288:f9oD+S8zhn8Z+RGOR9UJWzflQ9PWPIsDq:f9Fd2+Ma9UkJQtWPrDq

  Score

  10^/10

  amadeyredlinewelldiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1