Extracted

Extracted

Extracted

• • Target

    ca81c3bc6068da101462e452063ce359159de831a26a4ab23c012146959fabfb

  • Size

    1019KB

  • MD5

    a9bbedc43b82c8ede159b46f5690497a

  • SHA1

    ce69cbc04565f2be3f0bd34f8209acce7c52fe93

  • SHA256

    ca81c3bc6068da101462e452063ce359159de831a26a4ab23c012146959fabfb

  • SHA512

    c77002919e884f3afed6e678f46451183b6cf8024f8798cd16d95d5bd32dd2a72a413fa519cd1df971ebfea45b7ee1120597d32acd3518f76acb171834ac0ec3

  • SSDEEP

    24576:pyFPWB6uGzxG1YtLj4vrZXud9iIqvvLIQuKU7+JW:cA6E1YtLjcc9invTIpzSJ

  Score

  10^/10

  amadeyredlinegongsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1