Extracted

Extracted

Extracted

• • Target

    0325e039a383cbb6b8c9bd5005ae70e0a28e67d352e32ea3080ff4bf21bdd321

  • Size

    1010KB

  • MD5

    77441ed873788f58e2da20b55264eff7

  • SHA1

    d76382f46bf6c47898834449aa77dc97e3c3725e

  • SHA256

    0325e039a383cbb6b8c9bd5005ae70e0a28e67d352e32ea3080ff4bf21bdd321

  • SHA512

    c3be1f02c219c4b1a77cc92c20d61a4961e912d4832fc330402b94ac7128f10f29f4b9ba15f5374bf63274fd2b9d05fd09ea70d926e8e39deca9b7f291ba5662

  • SSDEEP

    24576:ay+W6OkPYg0Hm7RDfap8lIFLYHWkMdJK4uBW8jUbi7N:hp6OI0HmZ5IZYHfMfIW8jv

  Score

  10^/10

  amadeyredlinedownvolyadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1