Extracted

Extracted

Extracted

• • Target

    4edfeffad453624420cfeebbbd4a06c4716a8bea7d0b380ccf556b8350ae73a1

  • Size

    1.1MB

  • MD5

    ee1be07b022249cc77ebcc05d1d6f6e8

  • SHA1

    266cc699f96bff198763f2c2d742b77959e96d24

  • SHA256

    4edfeffad453624420cfeebbbd4a06c4716a8bea7d0b380ccf556b8350ae73a1

  • SHA512

    cb40bac684e52d232b61159096fa9fc36aa3a37137fe9103547df9e885f631d5d3f79d5871035c47a2db61f0477b45027937944b3bf55b85efadd3873231c08d

  • SSDEEP

    24576:72tTN3Ei6gLWwbtGxXyPyLMShCmoA6mTUpuT:ITNEg+ytbmoAJo

  Score

  10^/10

  amadeyredlinemangovinadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1