Extracted

Extracted

Extracted

• • Target

    1d385b018e8e30de8e3a372a9bb82a442e860c9fef16cf002070702864c25dc0

  • Size

    976KB

  • MD5

    ee2a57faf5aae66867873958152176b1

  • SHA1

    2cc26e51da652c5a63cf6ac1854f49385b59838f

  • SHA256

    1d385b018e8e30de8e3a372a9bb82a442e860c9fef16cf002070702864c25dc0

  • SHA512

    f4806f175b083d51d5cbeb600ed2b4a2fe55c239b4a232f2546962540d617659e342813eeeb585aa080c3e36b9914bc208eb1ca8a7c6c9a0ac93d48c8c743050

  • SSDEEP

    24576:uyIWUyX/PTSrzh3EPvzdUDsplKzD4T2iGcjKiUg08Hjj:9Yg/OXh3g5UMKn46iGcjKi7F

  Score

  10^/10

  amadeyredlinenordrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1