Extracted

Extracted

Extracted

• • Target

    575bbbbd774f8ddf215d0eabad8eef95c098a0aa05773839ae2a247d7e092b18

  • Size

    1.0MB

  • MD5

    83e40b7829024286df13fdcb08f0e72b

  • SHA1

    6c064c865472dfa2d56123ba0435c77d039d44b6

  • SHA256

    575bbbbd774f8ddf215d0eabad8eef95c098a0aa05773839ae2a247d7e092b18

  • SHA512

    dfd02274ed0b1e129e08ca809ccbd8cc711cd8580f3802c3e12a1f6db5f0aa6ad0546650d05d70cf80bb55622e906abe467193b7d1b11fd2e6223cdbcf2f84c2

  • SSDEEP

    24576:iiX3+kOhUNnwQvzerMp5rOk6gsBZYA5dRe9K:z+kOhKwQ7Mi5rh6gsvJpa

  Score

  10^/10

  amadeyredlinemangovinadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1