Extracted

Extracted

Extracted

• • Target

    f77fc5f71d18fc906e33f7e105c6a43ae0480b2e3272f1ffd4edb1c421979f43

  • Size

    1.2MB

  • MD5

    f689a3e1ab4d2dcff5a3508dd6f96900

  • SHA1

    c39b84609128a6a25bed478c15782f977901e6ff

  • SHA256

    f77fc5f71d18fc906e33f7e105c6a43ae0480b2e3272f1ffd4edb1c421979f43

  • SHA512

    c4cb05fb79ec24cbdb96c156cafbb862de82850b4bbb6ac3b43f163a360377ae93d6097f9acdf8b07b03703df8e124a2c0cad2d522523ef271da5972e5e85eee

  • SSDEEP

    24576:rgcL02I4/sr0X8KvEjUS3/XxExcPXxp2eCEpH:rgcL02Ix2SPX2+PX8

  Score

  10^/10

  amadeyredlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1