Extracted

Extracted

Extracted

• • Target

    91440b6bf544dcd67f4b4f8ef4cae493e496cce2921833e3f2141607a1521b66

  • Size

    992KB

  • MD5

    66889b3f3a57983b08574f4a4da5fdcb

  • SHA1

    8876f3cfd83fb37959bfdd1cffd389c05343e24c

  • SHA256

    91440b6bf544dcd67f4b4f8ef4cae493e496cce2921833e3f2141607a1521b66

  • SHA512

    a214e28e9e7b3a3f40afa0b17caa632cc7c0aa09cdfa78899e8534946bd927a203184adb736dea6db6b7abaa6e8646df125878334e0dbf747a47cc8dbabf0550

  • SSDEEP

    24576:+yQ5XcU9FhQVh2aNXCuZKYvkS0/Ye5G8xEsLRfL3oHfBgru5C:NioVh/C3Ye/Y6fLVLYHCrw

  Score

  10^/10

  amadeyredlinelinkrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1