Extracted

Extracted

Extracted

• • Target

    aed1873e4aac7a536506476f3b1a64f60f967eb14e6528edc34ace3814fbf65f

  • Size

    1.1MB

  • MD5

    c87135a3bb8c07df63f84d391b07bd63

  • SHA1

    5a02facab23bd4aa2ed06330f619d4574a989896

  • SHA256

    aed1873e4aac7a536506476f3b1a64f60f967eb14e6528edc34ace3814fbf65f

  • SHA512

    af9b4e6d0a4ea7a26b2f6606986c3d486ed3a284f74ebdf73f162340a623cbfb2c4195e6f898ea22f83215a4c3bcd986529ba98b5417783393e1dfab18070679

  • SSDEEP

    24576:Z6CWreoE3DanVJXmxRBmVedEOzzqIgU/54f2pyRQjgAL:Z6HgQM+edb5IRm

  Score

  10^/10

  amadeyredlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1