Extracted

Extracted

Extracted

• • Target

    0d7f69d1fb28608b6057b1f545e4203caf5a9faee4a559083c48092bef27e27d

  • Size

    977KB

  • MD5

    8477f5ffa739461d3a0799a0c6b83172

  • SHA1

    25127f2563574c91c6891676c6b44e6ec2425b03

  • SHA256

    0d7f69d1fb28608b6057b1f545e4203caf5a9faee4a559083c48092bef27e27d

  • SHA512

    4d793ebf6e0306b448af6f180310cbbc68a7c976c1b10cdbdf5a593e1e61987f53c22e030fee39c14d7f59dc0f84ad1adcd93f5a1019d753e74d97dea2e7d5a4

  • SSDEEP

    24576:AyXWIKkxfL06IPVxPzsPrhDrqAhghM3ugKx0FcX2PD:HXxfL06QV1YPrhqAXugrCXA

  Score

  10^/10

  amadeyredlinelinkrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1