Extracted

Extracted

• • Target

    9563a4db344b683001afa4fa1ff396ad9578f0a03f0f9626548c1a8f93096d27

  • Size

    450KB

  • MD5

    4ec5a154c4c7ba26e201d9d6135fc7c0

  • SHA1

    0b3970bc60220f4d34579d4189ecebe29c29abcc

  • SHA256

    9563a4db344b683001afa4fa1ff396ad9578f0a03f0f9626548c1a8f93096d27

  • SHA512

    832d61b9f5b4618aa115ff3dcd17b585ea388297bd4b49e3dcc24e305e47586f285e4c1c83715ce436386c2430ed793caeba4002be2946a6a83dd9e593376b4f

  • SSDEEP

    6144:VpqCfjcHwMbLU3dw4QHVa8GcVCZMh9jbMxCC7Nx9ipAEzmq4JerYh0K:VkAkBbQ3EHkpZ+9jbMMC7diiEZ4ArGP

  Score

  10^/10

  amadeyredlinewelldiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1