Extracted

Extracted

Extracted

• • Target

    18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd.exe

  • Size

    1.0MB

  • MD5

    2af8eaa48a29c8f797e235ef1fa8f6b6

  • SHA1

    ed47aca3c4336827a1142412e98bb6eb6a210de3

  • SHA256

    18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd

  • SHA512

    e725ed99bc0b36bc2d11c3c9f0d8bf4ffa043bf77c65ccd036f27aca65440088c7774ad6d843815b709bc8a1358621053c227a2787033f3616e8abf67b580377

  • SSDEEP

    24576:HyYIZh1Ln374SWDoClOJP8lZT6AirPdt0Rv3URr/T:SL1DMSIBDTB6QR/U5

  Score

  10^/10

  amadeyredlinereivsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2