Extracted

Extracted

Extracted

• • Target

    6a04733cb048c187d0aa51b8613def2d72d0816789bf115ce115ea24e2666115

  • Size

    994KB

  • MD5

    b28f66cb650aa76084126220941213de

  • SHA1

    7298804a35341039909c91974305646bd74845c5

  • SHA256

    6a04733cb048c187d0aa51b8613def2d72d0816789bf115ce115ea24e2666115

  • SHA512

    401f022b5b3802b6b49088c84f511f5818f97212c64e28afd070d47df7184492bb5ba3c6e5e66f4261e41f76f139e580b115d68e3fffe006cc5659da43137937

  • SSDEEP

    24576:dy0ut9lCo3nD0eWC6+3wLDR5HbqFFyclsxjiq2jdw:40ut/fD0eNT3whVbmMclsx2q2

  Score

  10^/10

  amadeyredlinelinkrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1