Extracted

Extracted

• • Target

    871dfcc7217c5c16f3b5638540eb3e999b0815c3704ba8b70d809d17367fe7ca

  • Size

    801KB

  • MD5

    cd5e28fc1d6ff681fb019650c78b1872

  • SHA1

    e69cf6988db840394aeba4b6c8a52f81e3260a92

  • SHA256

    871dfcc7217c5c16f3b5638540eb3e999b0815c3704ba8b70d809d17367fe7ca

  • SHA512

    52f895ef65f20db5a6b5bf247e8a86f7e136dae7e027f1b960cd3c75feace6a8d13ea8c2ad5ff0f575efb57643764318b48fec59e6a3a2f7340c57d5a02e0c56

  • SSDEEP

    12288:RMrCy901b0WyeiPjG0jkkz7xHE5BOwchsn3EdEaFvtZz+noi+s1E:ny+XiPjG0jxtCOwbYFZIoi3E

  Score

  10^/10

  amadeyredlinerosnzimadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1