Extracted

Extracted

Extracted

• • Target

    54ef37946760352a8182b47aa22f07b84be3990a9292d7b0978b035f21ec830b

  • Size

    1.0MB

  • MD5

    d4afd035964690a3f1da12066856e44c

  • SHA1

    38ee8a0da8186848f916e5244e64fa7b414cbe71

  • SHA256

    54ef37946760352a8182b47aa22f07b84be3990a9292d7b0978b035f21ec830b

  • SHA512

    6d3daed635a41055827a7e4aec22c3ef20679e4d713b62eb10e042e217e3393ff5b7fc01a7713f3c9b090523f12c46dd3b22f5a7c6770a1523bda17c48e00fbf

  • SSDEEP

    24576:kyIM+bCB05HdbDuf5D/URRksq8oqqUcotVPLmPhkhv8Q6F:zMCB05sf5D/UTq8oscaVP6PuaQ6

  Score

  10^/10

  amadeyredlinerentarosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1