Extracted

Extracted

Extracted

• • Target

    9ad3b196bdf543b802e907b6bdc0c02eea7204a796b4af196bcdd20f3e4317e5

  • Size

    992KB

  • MD5

    4e9fc4344fefe31e3da508e4aa7e17bb

  • SHA1

    bd787bb26f9306ad86b3124d28a739ba4c9343b2

  • SHA256

    9ad3b196bdf543b802e907b6bdc0c02eea7204a796b4af196bcdd20f3e4317e5

  • SHA512

    2e908e2b6c43e18969d773cc666d8ca789a36d18489b39dc8823c86436c7967c9d9441e3eed5c62421bdfd6ecd7a6e9a450ff5a86ed4cd111d80025a11f7d35a

  • SSDEEP

    24576:DyQVwe46UyvEVEPBb5GPVbdbN6TA6k9kbi:WQeZwv9BVibYAZ

  Score

  10^/10

  amadeyredlineliftrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1