Extracted

Extracted

Extracted

• • Target

    a7587de78a2793f42949f435f4a30c5978a27f5fb2165d11ac92a3397a0b41c4

  • Size

    1010KB

  • MD5

    2f3886b0b7772abd56ae5789560e89fa

  • SHA1

    25351f098af17088653ba01cf1cd8139e373c5a9

  • SHA256

    a7587de78a2793f42949f435f4a30c5978a27f5fb2165d11ac92a3397a0b41c4

  • SHA512

    c2e8bf34e95479be085307467102bd6dbca0fa7a0b3501f4f535bbb51686e5ca9c4e7e931a2b8835a626a42afd5b4567adae2498f93a6d0b8903a7a449e2ff89

  • SSDEEP

    12288:BMrUy90jguoPUNvcews39AXwHl/sLXhlamd6miMgBRRbtjlNIjgsXkE77LLBqc:ly1Bfs39AXcarXgBRbXIjn/73lv

  Score

  10^/10

  amadeyredlinedownvolyadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1