Extracted

Extracted

Extracted

• • Target

    d968027240e2177413bb65480b9352c868c6a0b43b2da413d7b3d991261edf5d

  • Size

    1.3MB

  • MD5

    814ee15921a105bef52f1b58f99827e3

  • SHA1

    ff68ba2afde4d1ba3bcf5625d812f77434ace8ee

  • SHA256

    d968027240e2177413bb65480b9352c868c6a0b43b2da413d7b3d991261edf5d

  • SHA512

    dc1bc3f45f18f9ac7e031d09e9092193d49fdeafd534791e1988ccdd1d0df377e57fcdea65dc770ac515ecab2e6859152aca56d2c4c5e7b7566afee0a8088728

  • SSDEEP

    24576:MnzPcbD/h1btFFh3DEYckeYbP1a3S3zLXGowWuFV3EQ1LQi8Pti/STV88Av:aC/hlVhFcYbw3SjLXGoDuvEQ1LQBtd61

  Score

  10^/10

  amadeyredlinedownmaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1