Extracted

Extracted

• • Target

    615043631f0a5cbd4486db6184f3e6e64a5a16ab2758c9bee7c8a4131407d71c

  • Size

    800KB

  • MD5

    07ee757ec47269b017b982e047746626

  • SHA1

    3620b102b59d047f740e733aa81af38891e5700f

  • SHA256

    615043631f0a5cbd4486db6184f3e6e64a5a16ab2758c9bee7c8a4131407d71c

  • SHA512

    d763d4eea247575c14015ceaf39618845d0fdc2cd2f909815e25bca87a8b0da7ce5968d37e039fc9f79fbc49f0b14c683f31262ead667e043ab3a21a5d1b24ce

  • SSDEEP

    12288:AMr8y90889AhgzT2Z8xvDN2d0IuuHH7XVMk+pDpXec3NltVK5V6RNkHX+n:sypMAh/EvJI9RF+YwvKINkHc

  Score

  10^/10

  amadeyredlinerosnzimadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1