Extracted

Extracted

Extracted

• • Target

    6c376e04ac060a48409f6f43b38739f03f76068a86b00603e0c8a47be8dcb8e6

  • Size

    1.3MB

  • MD5

    11bfbc6e8835a495d3d5252f44f6fe54

  • SHA1

    c09c69d7b8d358431e09b9dfcd7bad26efcaab97

  • SHA256

    6c376e04ac060a48409f6f43b38739f03f76068a86b00603e0c8a47be8dcb8e6

  • SHA512

    f60f180d89837cd5017cb9ba0c5f7958dd16a68856d45014b734cd923c1fd83f7005fa9cc6049c3e39dc18227a6a2eb12442e3afa648542d010a7938ae04880a

  • SSDEEP

    24576:MF7kbWMH5bL+ZmZhqNrZ8fngYq8u2iXhKsfMe+MVL538dWW:MCKE5H+ZmXqNCna8z4DlVL5O

  Score

  10^/10

  amadeyredlinedownmaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1