Extracted

Extracted

Extracted

• • Target

    7090f29c10e99ba876a747b722b28c622d6d7aad0f6c985bd64d0d50d5478b08

  • Size

    1010KB

  • MD5

    15a5590c4fb02904e5519940ec485288

  • SHA1

    40c5d62141c2178da73f145ec891d2c172b87f4e

  • SHA256

    7090f29c10e99ba876a747b722b28c622d6d7aad0f6c985bd64d0d50d5478b08

  • SHA512

    8dac71325cdb9a7376b97c1e917c45965e27e216f8bff967f03c036842bbea76ac0fde9e470b15ed11e79a4e0d24aa95b04029a674741ca61ebbd59e4a57c63f

  • SSDEEP

    24576:XyorZUi1Pbo5T7IKvvwzrY86KLuTVSIC+51GQUvBW+aGT:ij2bo5T7V0T6J1hHHG

  Score

  10^/10

  amadeyredlinedownroxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1