Extracted

Extracted

Extracted

• • Target

    540acb6012a8c4bb69aeb88a36ae4a2fa721e357e09a60209eb5c761551b56e7

  • Size

    989KB

  • MD5

    094fffc08fdddec552be693e72c8a30b

  • SHA1

    d6804436a13dff3bb98a216da2c34c638187effe

  • SHA256

    540acb6012a8c4bb69aeb88a36ae4a2fa721e357e09a60209eb5c761551b56e7

  • SHA512

    cc2374fcac4ae6735459e47b3bc092abe867d7a396f1f9dd94d853b88961c00b4cbe37388d6374c10a853c217dacdf99e2c58b7a92e21781ee6daf09fe5c0702

  • SSDEEP

    24576:byFpGwUDej8uMPkqNrQyZzECe132CHdkEHRjUWK3KA:OCwUiDMkCZV5e9B9FUWK3K

  Score

  10^/10

  amadeyredlinelinorosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1