Extracted

Extracted

Extracted

• • Target

    a130aed5cb32920a88a7b7607655d00dcfbe86f14505822483c759040854a696

  • Size

    1.0MB

  • MD5

    2a28a7f7aa79a0927029ccc512d1dbb9

  • SHA1

    ba2312dfdf07bff36ab4c426f955e987b42a51cf

  • SHA256

    a130aed5cb32920a88a7b7607655d00dcfbe86f14505822483c759040854a696

  • SHA512

    2f985fb1ff1447c884717bfaeaa6841134c2968d58bf4cfef358635fb9d7cba738ed526acc2ff879eb06a5ae8084d06f02968644c1879a41a6a1185f885d2a8b

  • SSDEEP

    24576:XyLgjj3dl82fSf31yKAsebMkTNyi3D6wzo15Gp:iLYjtWOSv1JA/9D6waE

  Score

  10^/10

  amadeyredlinerentarosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1