Extracted

Extracted

Extracted

• • Target

    7884b22c7592f4d4c2cd245a74556c37b03306315cb47088b4f527c4070d0726

  • Size

    1006KB

  • MD5

    f46639d70f904e15f955abd022c2d3c3

  • SHA1

    ab521ebc19ab4dbe1b5663ac4bd7fc60426dba0b

  • SHA256

    7884b22c7592f4d4c2cd245a74556c37b03306315cb47088b4f527c4070d0726

  • SHA512

    b8d0d45c7888c4332b22ab60fb99cc2a71f41c1e2d918bbaac9625fad8b6ac3d0cb193c305eb14b41ffc221db45019e82fd6fc0826f50bc2cba04be54af964fa

  • SSDEEP

    24576:Oy4qwpaXr9kmZBc7Fx8tm2lrUnjLXoJigEq:d4Lpab9kmZKZWs2Z4XaE

  Score

  10^/10

  amadeyredlinedownmaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1