Extracted

Extracted

Extracted

• • Target

    8d6151c4f148d8c4e997fffa371dda1e20e0d4b4b8f319ac6006b0506ee62a5d

  • Size

    1001KB

  • MD5

    8467bb05c51916f21d07c61159dbcd26

  • SHA1

    849d4d14a25c579c5103c466b3d1992228157efb

  • SHA256

    8d6151c4f148d8c4e997fffa371dda1e20e0d4b4b8f319ac6006b0506ee62a5d

  • SHA512

    773538c8df8a04d498e22ea184cc2cc917d86cecaac5e344676cddc512939388c8ded394ba25ccb700af124700d2f72762f357000fdb13c3359a4db22ac5b3bf

  • SSDEEP

    24576:6ydWhJlqbozg15EIfJujEDFikU5BU/Tn67A3vNE+:Bomaq5E+JHDBU5ahW

  Score

  10^/10

  amadeyredlineliftrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1