Extracted

Extracted

Extracted

• • Target

    d519360dcb11d9f09e0d4455e3b26558a79d29d5215ea66a5864ac6f1d0633c5

  • Size

    992KB

  • MD5

    917df7ba6da5ccc28f5d0e88610eb8d7

  • SHA1

    c4e9d54454726d0a67952e9b3bdd19faf2f1d9ca

  • SHA256

    d519360dcb11d9f09e0d4455e3b26558a79d29d5215ea66a5864ac6f1d0633c5

  • SHA512

    c4682cc5c3a2daa9b60d26d046e38b408a2ef33d3f501e0d47161cc7037f0a2bdb610733695a9d6a758a119396f00b1e1eacd5f14c75a4d005055d26fa7cba9b

  • SSDEEP

    24576:YyJ54jGHGkqYaIdrBb+HiLz6Db5DPImIZ:f34jGtq3IdjLuR4

  Score

  10^/10

  amadeyredlinelinkrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1