Extracted

Extracted

Extracted

• • Target

    9e85410825b48d584df712cafc5eb6d76c2860118221e3499da20bac488f644c

  • Size

    1.2MB

  • MD5

    a4ed479ffd250797f6b0f81a24087999

  • SHA1

    7074214dc43684d0412d5fa6d749b980be770702

  • SHA256

    9e85410825b48d584df712cafc5eb6d76c2860118221e3499da20bac488f644c

  • SHA512

    003d63878c02853c2b661050390f70fea9b9b7a32c4052492340a7dec089dce57945bc315dffc04c57918a83c10f7ad67368c09bd549cd36fa4adac036726f45

  • SSDEEP

    24576:S8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:S8cZSJ+ORYeYDqngTl8+c

  Score

  10^/10

  amadeyredlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1