Extracted

Extracted

Extracted

• • Target

    157b661bdbf1ee4e7de9e95a85106f0f2213a6a4a1eadfb375b40d979b9c67af

  • Size

    1.0MB

  • MD5

    8ba7437401a464a30553e32855bef095

  • SHA1

    48557556d4bd45043a980f9cc4cd6920148e5548

  • SHA256

    157b661bdbf1ee4e7de9e95a85106f0f2213a6a4a1eadfb375b40d979b9c67af

  • SHA512

    78686e96d2a235c3ae6adf1b4f1bd6e46d961677e9c7cc6ba45b801a86c9d7ca1a6d988f7a14dc0988964c6228b69b2030cc66efe8b07549b437633529bb8755

  • SSDEEP

    24576:IyWNBCH62L3Ps1HatBmMorzjgbmmQUo0a07yBfBHJM:PWNBCH6g308MPgqm9oeyl3

  Score

  10^/10

  amadeyredlineborislidadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1