Extracted

Extracted

Extracted

• • Target

    1803110eace66f762f339c78c01f3a87d2029d20971d155fd02409599cc88e13

  • Size

    1005KB

  • MD5

    48f89f1a6642e2f45ab19a8ccccbbd57

  • SHA1

    361b36063a8f68544f333968c203e3f43cf81193

  • SHA256

    1803110eace66f762f339c78c01f3a87d2029d20971d155fd02409599cc88e13

  • SHA512

    7b6e3d6b3cf3f4b38d0cdbd0274d238fab699831ac06652eba1b47d9d1adfe3b501f92335d6480ba5b56add8b635d4e107b74abc976b66134a28a770260e75d1

  • SSDEEP

    24576:UyNAaCTptLYnvGMm/amadYbZ0mJhm8hag8hY8FBWYH:j2aClqR4aOb2mfLsVBWY

  Score

  10^/10

  amadeyredlinerentarosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1