Extracted

Extracted

Extracted

• • Target

    c86c25a34b7b48d78d38a635e9d3276c3745ebd844fb4ed8fe3cc0f643c28411

  • Size

    988KB

  • MD5

    1ad88613c4a8a3178b6088eff1b6dd03

  • SHA1

    1e205a61b5367d8892e266ab7004dc99b9fcdef3

  • SHA256

    c86c25a34b7b48d78d38a635e9d3276c3745ebd844fb4ed8fe3cc0f643c28411

  • SHA512

    8f36cdc5545a25d25d3f26a98c012903fdfe9caafb3d815ee10ca10843b2e0cab01e64e92966291e06f8b55207f3764a28c5df1c44143012ff574f56fbe01e69

  • SSDEEP

    24576:DydZjKY49NLLll/W28h8AVQTduSFd0Ft6Y5yOMyZJQfMI:WdoRbDy8AVEkYOFt6OyOMyZuM

  Score

  10^/10

  amadeyredlinenadorosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1