Extracted

Extracted

Extracted

• • Target

    f471f242086acf782b882a2fc29e8446b38e588e4b8176534ffdf64874ee330b

  • Size

    1004KB

  • MD5

    1753b662db87fe3b04ee095f42d42fc5

  • SHA1

    5a5a103560ba704020b04190c35227eb03a7c732

  • SHA256

    f471f242086acf782b882a2fc29e8446b38e588e4b8176534ffdf64874ee330b

  • SHA512

    f7dc2141ae28c7bb7c3d78993b6c7d761e5dcf467873ea4ee7d0433e4a8f2aeebce43632606d58764d2bfc476a07e74885ac9c03096f564137eaca671d1ee8a4

  • SSDEEP

    24576:dyXbQ7ZxC/91bfVPBMamEWMDmlBZnagB2JpIGhvAV:4XoPC/9NVPOamxM2FoJpIG

  Score

  10^/10

  amadeyredlinerentarosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1