Extracted

Extracted

Extracted

• • Target

    b88d79c1f3d3d8b1770f2ab7d8e06c6b69422087759a004933616e73fac96e61

  • Size

    1007KB

  • MD5

    ed5236cdd2cf6233ba14473e13a1d827

  • SHA1

    8b124482ab18d429ccc1f095a2b2eab74cad7b3e

  • SHA256

    b88d79c1f3d3d8b1770f2ab7d8e06c6b69422087759a004933616e73fac96e61

  • SHA512

    b67407f6db0b76ed328824b48d9047effee1e036edd1f45afb34fbf6edd66f305df3465cc2da114c415575cbbf3d202d95ffd5d66c076af76e1a8bd91f27083e

  • SSDEEP

    24576:lyYIfgDGM1IOBu/APy5nNFtExApXZDwvtq3C9VBpZVbM:AYy9Ue/APWNFCxMXZ0X9VBfVb

  Score

  10^/10

  amadeyredlinenordrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1