Extracted

Extracted

Extracted

• • Target

    453986a163a1d44510fd00fbab869a0c70ccaaafa7135c1c2f981d66a8fda988

  • Size

    994KB

  • MD5

    454388e3a589214dfc3b3795796285ad

  • SHA1

    9bb28bb849905ae96ae1d2700dac1c1559ada2db

  • SHA256

    453986a163a1d44510fd00fbab869a0c70ccaaafa7135c1c2f981d66a8fda988

  • SHA512

    879f1c2a85cea829f9d07bc29589cb3c16de54ca960f14c51545d1ae85bdcd7d38862849e9d082f5032f96189e1023004d398ea948a085b5f6ceb99fe42c3ac3

  • SSDEEP

    12288:CMriy90A6jmA92W6rZVQQWcabEgE+zxaXIHfS/gNzGrxlVKuazPQdb8Ph5xFI9st:cyMEWcZp1+zxgIHyaGrxlPaUbA7I9st

  Score

  10^/10

  amadeylaplasredlineliftrosnclipperdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1