Extracted

Extracted

Extracted

• • Target

    53318b48026e44ef4a7f01fac7c91a95bf14a75fcea0aa693a0cb7d9379b6845

  • Size

    1.2MB

  • MD5

    252d99c354eb5b33744ab07fbb5e134e

  • SHA1

    c8652a954d215584a32a351f4e5fdd1128ca295d

  • SHA256

    53318b48026e44ef4a7f01fac7c91a95bf14a75fcea0aa693a0cb7d9379b6845

  • SHA512

    14fc1578ba3cab0db4ff4cbf97c77d0e6f1154871edc3de8a0e2cc15e081e247af1a430a06727c2eba92b402111f4d50d59d11db2895be4705064d958de90fb5

  • SSDEEP

    24576:igcL02I4/sr0X8KvEjUS3/XxExcPXxp2eCEpH:igcL02Ix2SPX2+PX8

  Score

  10^/10

  amadeyredlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1