Extracted

Extracted

Extracted

• • Target

    bd4275e2ed036d82ad1607a306e1c85ecd343fe57c70b4788a59e06678a7ef06

  • Size

    1.2MB

  • MD5

    61f4a570bf0a14213deead20ac6fff6f

  • SHA1

    6fe7c6592ff42beda2f29fb39b8a0906ede51137

  • SHA256

    bd4275e2ed036d82ad1607a306e1c85ecd343fe57c70b4788a59e06678a7ef06

  • SHA512

    95ed1c079a949ac0032ab19c361a02e3ee70a5bebeed96a417bb86a7abd6a09b565f6f84148c581421f9be8f76a7a96877875eb27b2ec8ac5e17b5c320d95e86

  • SSDEEP

    24576:v/2WGBYAAi70X42LDcFs2v/U4kKrT9dudKFtV:v7GH7Qxov/U49T9d

  Score

  10^/10

  amadeyredlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1