Extracted

Extracted

Extracted

• • Target

    9a4042fde6b82e9c8e8bfeaa8ee0ba8dd75c56647b7cd8e13cb3c91f73126828

  • Size

    987KB

  • MD5

    04ba3a928588f233e9aecd468378a2d3

  • SHA1

    bcc548ff98e91ae5b4f2c235f8ab66b0c4af0b57

  • SHA256

    9a4042fde6b82e9c8e8bfeaa8ee0ba8dd75c56647b7cd8e13cb3c91f73126828

  • SHA512

    a3c57965fced5adcb11d2c31714268303d6dd99fdc92e2a8b15d9c54b88447f513a8493f87194c0f59cd1bc3f95984cf123a0ef06fe6f935a45182d25a76ece7

  • SSDEEP

    24576:lyD27WLeq5BUU01zJ9yqip+huY0oee2skjuEc8H:A6hq5BYJQRp+uFoee2skjuE

  Score

  10^/10

  amadeyredlinenadorosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1