Extracted

Extracted

Extracted

• • Target

    8009a87cfd8e5c268d4d413f75c2a94f234d6dfb1abe93729b115fa1a486dce8

  • Size

    1009KB

  • MD5

    2d0fa4098543f8a1be8223ab10032593

  • SHA1

    efc55bc775f9088c51253333cfd28b08197c0170

  • SHA256

    8009a87cfd8e5c268d4d413f75c2a94f234d6dfb1abe93729b115fa1a486dce8

  • SHA512

    ee51446a3dfda649ca30edd5955c8201e15bf52702dac9982c79a93414046eb72672d2b5b2753c6e42a13b46d6b7dbab4952249fe02d4f6333f24ef8d5d6f351

  • SSDEEP

    24576:yyQ/FuMHNr493lVz3V/Ro5/O/lbttK6y41+aHd+pQ:ZQNuSN4Rrzl/+FO/tXK6y41vHc

  Score

  10^/10

  amadeyredlinedownroxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1