Extracted

Extracted

Extracted

• • Target

    f0dbfff139c4179c20ca46dc75cf2034e49b9dd8894e6828f47f8d625a8c1c2c

  • Size

    1.2MB

  • MD5

    f63f3bb0db58d6f18d048ee814aaf1b8

  • SHA1

    e0a0381b5171065c7648410aefdd9532683cd06b

  • SHA256

    f0dbfff139c4179c20ca46dc75cf2034e49b9dd8894e6828f47f8d625a8c1c2c

  • SHA512

    0258fbaa3bf56f482b7f3b826f2b0121df82e8d9e4b8c40f3aa63a291bf73dc99cfc96ee2ea95dfbf674050d553cd4a0ec8b383284accbe48d96fcaff16b29ed

  • SSDEEP

    24576:wpRHy5AtvKTBGVBVPnTNAf0r99VlLYLTKJ9:Kty5AtgUB9TbLK

  Score

  10^/10

  amadeyredlinemangovinadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1