Extracted

Extracted

Extracted

• • Target

    8dcb41171090cc3a1e171e1d941aed7f7ba566bb46050dca1a59fbc5ac826a7d

  • Size

    1.0MB

  • MD5

    24e76c6617d242493da96d2688009d91

  • SHA1

    7338dd4012ea4c94e64380c7a7e0ed23350e465e

  • SHA256

    8dcb41171090cc3a1e171e1d941aed7f7ba566bb46050dca1a59fbc5ac826a7d

  • SHA512

    81f43de421ce50cc0f2b2673ccf1d393bda5315ac469802648002024a16eefbc43f080bdff3f57153d16eb5aa937421343f45f8b7e2cd5c497e6457622e055e0

  • SSDEEP

    24576:zEpyOrvFcO0dYLJ0hMn9kTYX0cs/hvB1c9+E:zeyOiO0daJ04KYEE+

  Score

  10^/10

  amadeyredlinemangoritadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1