Extracted

Extracted

Extracted

• • Target

    61eab3811c02885bafa1aade7d09b51b4bab54b9404e6de4670f2b90302553c9

  • Size

    1.0MB

  • MD5

    24822fe3d0265ac13552cde42cc5e74c

  • SHA1

    46c7aade18db5e9eac91625c93518ec7a311e312

  • SHA256

    61eab3811c02885bafa1aade7d09b51b4bab54b9404e6de4670f2b90302553c9

  • SHA512

    0ab26d6488e82cc494680d889d3c891ddc2fd0dcc8b34d5f2062bcf01fc3fc279195e54b20d0d6baeebce12e9ecd6b5d1d8e70579a64cfa28e95c6e73d039ce6

  • SSDEEP

    24576:wy9JZNfOUOCFXY+jXwM7kHKR9hWMkv2JFR+V:3rOUOCJY+brkozRw

  Score

  10^/10

  amadeyredlineborisstopdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1