Extracted

Extracted

• • Target

    778e121075c65e93720f9da51e9f50ac0e3ad0a7c726e89451314ba29dd6d574

  • Size

    731KB

  • MD5

    a75185059de32e92a588e73854b69e0d

  • SHA1

    fad519cd3b48f61987b73ea3bfce648e700b9734

  • SHA256

    778e121075c65e93720f9da51e9f50ac0e3ad0a7c726e89451314ba29dd6d574

  • SHA512

    b87cec3c8aaf7d4973a00514b3932b65ddf385e24cb23d7deaf1aab1c830430f2cfad5b5c9cd1bc6621a897c064136c82a339f882a53982e3a06c52316159ec8

  • SSDEEP

    12288:h6dXxiiXlaX8tyT1t0Dw+60hOd2L4CUPKgCPsZ+vIjGUlQsh3:haBiawZkw+6iOG4ygCPWQIjG4Fh3

  Score

  10^/10

  amadeyredlinevinadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1