Extracted

Extracted

Extracted

• • Target

    86918a277d0440329c1ae0f7876ef008e71475b4b7e6f7fee27bc9743ab9b5ed

  • Size

    1003KB

  • MD5

    a4f8134861941fa76a94a01470a99452

  • SHA1

    af1dd94b7ca8a8b0711963f06b2db00b62cb78e2

  • SHA256

    86918a277d0440329c1ae0f7876ef008e71475b4b7e6f7fee27bc9743ab9b5ed

  • SHA512

    a1a828da8e8125efc562197aa486432858504a7cf305c91d60a84dc71588cace3dce58d4fd3c12c3ff8a9e39d10d0880f1096a5bad6f24c7066c5a4f756caa02

  • SSDEEP

    24576:HylRkA7mj2VBqjpngej+tTQi0hNVJPNrulRDYjfJ6x2:SlRF7zkW0YUi0hNrFrulRqR

  Score

  10^/10

  amadeyredlinedowntrapdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1