Extracted

Extracted

Extracted

• • Target

    5e3dc1121184411194c3d19b58070af0cabe7cd2491747336e44362278f50fe2

  • Size

    1001KB

  • MD5

    00f9734e084456436dfe29359bb40d46

  • SHA1

    2866e6b2944234dc5851ae78168d3b05af82297f

  • SHA256

    5e3dc1121184411194c3d19b58070af0cabe7cd2491747336e44362278f50fe2

  • SHA512

    7b55a2a561efe5c8b7c4805cf28e8ef2426535066817deceb9152e23f322b589f51d7a14f9b74bbc2e773dce240cd00c58e0caec183b7a48a83548cb54b41cb0

  • SSDEEP

    24576:LyvKT/vOCmI8Zf1b/2PgzyrK9HPhvyLst7BoUu/W:+UOO05/XZhvyLs70

  Score

  10^/10

  amadeyredlineliftrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1