Extracted

Extracted

Extracted

• • Target

    c18d8721447fdd190551102864da7fa997250f2878b672dafb2b220026dcd751

  • Size

    1023KB

  • MD5

    dec68136fa165f5b5ebf461dfcd74a5a

  • SHA1

    c66a2d92cf412649bacf06de00f4bfc6359812eb

  • SHA256

    c18d8721447fdd190551102864da7fa997250f2878b672dafb2b220026dcd751

  • SHA512

    05667a002e7a43874f10e2fad81621d594244527c25955f9ea1d69c0e13e11d5cb03312dee15f2f3749d4432e99dbac44b10b866565ae0ecebec6fc48bdbfc4b

  • SSDEEP

    24576:ryX79fr3JJqL1ufU1vijUoQM/f/HsvFqae45UmUv/l:eXZfbJUJKU1qooQMQp5G/

  Score

  10^/10

  amadeyredlinedowntrapdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1