Extracted

Extracted

Extracted

• • Target

    2d712a3b4055784d07b53b7f647d2d1c9e6a40656cf6d95fb12b7ddf8d4f8e89

  • Size

    1010KB

  • MD5

    c988e0eedfd99422bfcd5cbd84a75fe4

  • SHA1

    99dc96fff3a5745711b7df92cc404ff23734b876

  • SHA256

    2d712a3b4055784d07b53b7f647d2d1c9e6a40656cf6d95fb12b7ddf8d4f8e89

  • SHA512

    38ce091c613c3bb244c19435379fc8a7d8a6342c84eb8756969fc207cf25c4755844ed29570a4f9b6b77584aa720995a3e91134431ebea1fefb87e3a19a46cbb

  • SSDEEP

    24576:iytZ20FjcbkZ3fF0gDvqZJE0ie6YIP1lod1xuXEXcR:JnLZPF02vqZJAXjPETsXEs

  Score

  10^/10

  amadeyredlineborisnervdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1