Extracted

Extracted

Extracted

Extracted

• • Target

    0x000800000001336a-1070.dat

  • Size

    226KB

  • MD5

    b3d5a506b768f32f6db20b62e140359f

  • SHA1

    c92205037a7a639394d5c5e91772e425f8c7b1e4

  • SHA256

    e85c016276c0dcc23366778337d3c613305caa9b2b873abed8f70746ac31df5e

  • SHA512

    85c204ce293a9180e002cf435426facd4136caa8aeac117690c509e3809e62be3150847794e23ddafc97629dee3b86b4587005e4146fca052146a342d02bb112

  • SSDEEP

    6144:4rzyIG8IcCnD5A2QdY8rWpau1CYUqfhYdMBg:KmlLnD5qdY8Fu1CYUehrBg

  Score

  10^/10

  amadeytrojanredlinebabyborisdogmadiscoveryevasioninfostealerpersistencespywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2